Yes, that is correct. The statutory duty to report data leaks applies to the party responsible for the processing of personal data (in this case Vattenfall).
It is therefore Vattenfall's prerogative to decide whether a breach of security has occurred leading to a significant risk of serious, harmful consequences or which has actually led to serious harmful consequences for the protection of personal data. Whether or not a data leak must be reported to the DPA (the regulator) and whether or not the individuals concerned must be informed is a decision to be taken by Vattenfall on the basis of the information supplied by your company and Vattenfall's assessment of it.