Regarding your point if a low-level employee sitting on it, it's all a matter of education, training, policy. When GDPR came in force, the security team at my t

Regarding your point if a low-level employee sitting on it, it's all a matter of education, training, policy. When GDPR came in force, the security team at my then workplace informed every employee that any suspicion of a breach should be immediately brought to their attention so that they can help evaluate the seriousness of the suspicion. After such a policy is brought into effect, no employee will "sit" on it or they risk sanctions.