The lost reports did not contain personal data, in this case GDPR is not applicable and is a security incident.
Important
A data breach is whenever something that has not been planned with personal data happens, be it improper processing, improper sharing, loss of data, deletion, etc. In other words, personal data must be used for a specific purpose, respecting the life cycle of the same (from collection to exclusion), any situation that escapes this cycle must be reported as a data breach.

Article 20 Right to data portability:
1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.

A decision on the safety of transferring personal data to a non-EEA country. Incorrect. This refers to adequacy decisions.
A measure to compensate for the lack of personal data protection in a third country. Incorrect. This refers to appropriate safeguards.
A set of agreements covering personal data transfers between non-EEA countries. Incorrect. The GDPR does not cover agreements between non-EEA countries.
A set of approved rules on personal data protection used by a group of enterprises. Correct. BCR are a set of rules approved by the supervisory authorities. (Literature: A, Chapter 3; GDPR Article 47)

Reference:
https://www.i-scoop.eu/gdpr/data-controller-data-controller-duties/