Notification is required only if their impact assessment concludes on a significant risk to users (which they must be able to produce to the data protection authority at any time).

Otherwise, business as usual.