Law enforcement agencies should be notified if the breach was the result of a hacking, theft, or other crime, or if legal requirements mandate government notification