Why is it that all regulation has to do with protecting consumers? Where is the regulation that protects some businesses from failure or losses? When a HIPAA violation occurs more attention is paid to the one error a business had instead of tracking the thief. You never hear about the thief in the papers.
Everyone knows the TJ Max story. How much do you know about the thieves?
You need to protect your own assets and hedge against losses yourself. No one else is going to protect your organization. But all regulation, loss, theft, etc. raises your risk as an asset owner.