DoorDash data breach leaves important customer details exposed

In the faq and in a few places on their page - https://doordash.news/get-the-facts/how-were-responding-to-a... - They mention users “where required”, anyone know what that means? Did they only tell users in jurisdictions that require informing them?