This article from Financial Post explains the Digital Privacy Act that became law on June 18 in Canada.
It’s not related to Europe, but Canada. However it showcases a common trend in several countries. Data breach shall be notified.
The mandatory notification provisions require organizations to notify the Privacy Commissioner as well as potentially affected individuals of a privacy breach “as soon as feasible,” but only if there is a “real risk of significant harm.”
(Thanks to John and Alex for highlighting this)