That seems very logical to me.
What would happen if a business simply did not declare its breaches of data in order to protect its reputation? In your opinion, would the fear of contravening the law's requirements be sufficient to ensure that businesses will be diligent in this regard?