[the_duke]

With GDPR, you actually MUST inform government institutions within 48 hours when personal information is leaked.

The penalty are potentially very hefty fines. (up to 2% of annual revenue, IIRC)

[Gokenstein]

It is oddly silent on what government institutions MUST do within 48 hours...