An incident's technical scope is small, but it affects regulated personal data. What should determine notification obligations?

1. Whether the attacker has issued a press release
2. Qualified legal assessment of applicable facts, thresholds, and deadlines
3. The number of servers alone
4. The vendor's preferred publicity schedule