That timeline would only be in play if it was data held by Microsoft that was compromised.

Why? Whoever is responsible for the data, we could assume if MS knew it, the owner of the data knew it too - if it's not MS, MS would notify them immediately. Of course, there's an option that the owner is privately held, has no investors and no interested third parties and no clients - then there's nobody to notify and nobody to defraud. But who would that owner be then?

That law isn't in effect until the end of November. It's a new regulation.