The time constraints businesses are under to disclose major personal data breaches under the General Data Protection Regulation (GDPR) has been highlighted by the way an Irish retailer responded to being told some of its customers were impacted by such a breach, a data protection law expert has said.