In the U.S., depending on your state, security breach/data loss reporting is already mandatory based on certain conditions, e.g. California https://oag.ca.gov/p

In the U.S., depending on your state, security breach/data loss reporting is already mandatory based on certain conditions, e.g. California https://oag.ca.gov/privacy/databreach/reporting https://oag.ca.gov/privacy/databreach/reporting They also maintain a list of reported breaches: https://oag.ca.gov/privacy/databreach/list https://oag.ca.gov/privacy/databreach/list