secureschoolemail has been running for nearly 4 years. It's not just something that was created to take advantage of the GDPR regulations. Article 34 states that a breach notification to individuals is mandatory where it is likely to “result in a risk for the rights and freedoms of individuals”. However, if you can show that you have protected personal data adequately the impact of a breach can be minimised and the potential obligations reduced:
“…the controller has implemented appropriate technical and organizational protection measures, and that those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorized to access it, such as encryption.”