While the decision to do/not-do is up to the company; They still have to document it (in any case, even non-personal), mention the reason for not reporting (e.g

While the decision to do/not-do is up to the company; They still have to document it (in any case, even non-personal), mention the reason for not reporting (e.g. "it's only an IP address") and make that document available upon request. So if the breach turns out to be a bit more major than then want every one to think it is and it turns out that it was major in the end, there either is a paper trail or worst case for them no paper trail and probably a worse fine.