That, and 280 or so company reviews, conversations with compliance officers, CISOs, auditors, pentesters, lawyers and other people in the M&A space about how those companies deal with security issues, reports and what constitutes a potential breach and what does not.

As for the absolute facts of the law: the only law I currently have in mind is the GDPR and that is a surprisingly readable piece of legislation.