GDPR is very popular here on HN, but I think it's important to keep a level head about what it actually does and what its real-world effects will be. That is the entire point of this thread, after all.

The difference between "not having a breach" and "a legal obligation to announce it within three days" is not semantic. It is absolutely material to the real-world value of GDPR, and claims about it should reflect that.