Doesn't that depends on how well they separate access within the company? If they know that one of their support reps in Costa Rica was "turned", they might not have to declare anything in the EU if they can prove that the rep has zero access to EU customers.

Edit: to be clear, I don't know, it's a genuine question. Does "any breach" count?