It's handled by the GDPR. Companies are forced to report a leak to the authorities and the max. penalties are very high.