We do have privacy policy on our website. It states that we don't provide personal data to third party or any other authority. It remains confidential. what do you mean by "Data breach plan" ?

This has nothing to do with a privacy policy. A data security plan is a plan that deals with data security breaches, just like happened with you. If you have no idea what a data security plan is, then this business really needs an attorney as you have many holes in compliance and operation. Good luck.

I have a complete address of this hacker now. He is using different paypal to steal money, different credit cards fraud. Tell me what should I do to stop this hacker first ?

That is a question for your IT person and contact with a slew of companies including every single credit card, paypal and so on. Good bye.