GPDR or whatever it's called requires it. So pretty much the entirety of the EU... Or companies with offices in the EU ... So if you're an EU citizen, you should have been notified by law.