If it comes to a data protection violation, then the responsible parties and the data subject must be informed per Art. 33 and 34 GDPR. Individual companies often process data on behalf of other companies within the group. Therefore, the establishment of a uniform system within the group where a quick information exchange can be held in the case of a data protection violation or similar cases is advisable.