With GDPR, you actually MUST inform government institutions within 48 hours when personal information is leaked.

The penalty are potentially very hefty fines. (up to 2% of annual revenue, IIRC)