> I'm not sure about how efficient the process is, but there is some enforcement.

At least in Germany, it's okay in some states, essentially non-existant in others. I've reported some serious breaches, and about half of the responses were within 5 days, the other half haven't happened yet, after > 12 months. Reminding them just lead to getting an official case number, so they didn't forget, they just can't/won't enforce.