Mfcttrf

Should it be disclosed to a company that a number of their employees have been involved in a data breach, particularly one that has released special category or sensitive information; what is standard practise in responding, or passing this information along to their employees?

To be clear, in this example; employees often use their work email addresses to sign up for other websites for personal use (very bad practise, but surprisingly common). As such, any organisation monitoring OSINT (open source intelligence) feeds in order to be notified of emails being disclosed in a breach will become aware of which of their employees have been impacted.

This raises a number of questions, and I am hoping the community here may be able to provide answers from experience or practice.

1. 
   Is there any precedent or obligation, legal or otherwise (UK/EU), to inform the employees directly that they have been involved in a breach?
   Many organisations would seek to avoid the discussion altogether for fear of recrimination and a perceived waste of company resources assisting/investigating. What is the standard practise in such instances?
   


2. 
   In regards to 1; are there any circumstances or regions where it is legally mandated that the employee be informed by the employer?
   Should the breach be revealed to contain special category PII, sensitive or financial information that will likely bring harm or distress to the employee, does this change any answers?
   

Are there any defined lines that, when crossed, typically force a company to respond?

I'm not looking for moral or idealistic responses. I believe in a perfect world we would always disclose the information and everyone would go their own way to resolve without conflict. I am trying to understand how organisations actually respond, and what the common response to such incidents are.