Notification is required only if their impact assessment concludes on a significant risk to users (which they must be able to produce to the data protection aut

Notification is required only if their impact assessment concludes on a significant risk to users (which they must be able to produce to the data protection authority at any time). Otherwise, business as usual.