I was recently told by someone who manages a security team at a consulting firm that not all security breaches are necessarily incidents. If someone breaks into a machine that has no file access auditing enabled, one can prove that no sensitive has leaked, and therefore, customers need not be notified.
But I don't buy it. How can anyone prove after the fact that no data was read without any auditing? Any data read could easily be scrambled on its way out, so network logs don't necessarily prove anything. Furthermore, any touched file can easily have its timestamp reversed, not to mention that there's no way to tell who precisely last read the file (e.g. was it the true root user or the hacker as root.)
As far as I know, there's no way to prove what's been seen during a breach unless there's something auditing the file system at all times, and therefore, it's an obligation for companies to notify their clients that they were hacked if a system that contains sensitive data is ever breached.