OK, what about: If a company storing private customer information gets breached (sufficient evidence is found of said breach), then the company must make itself

OK, what about: If a company storing private customer information gets breached (sufficient evidence is found of said breach), then the company must make itself fully available for a third-party investigation to confirm the existence of said breach. If the third-party investigator finds evidence of a breach, then said breach happened. If not, then there was no breach. If one third-party investigator is an insufficiently reliable number, then what about the best two out of three?