Yes, it's been part of the regulations in the EU, even before GDPR. Being forced to disclose in a timely manner ensures it can't be swept under the rug because they squint at the logs just right.