Who should decide whether a file incident requires notification or business escalation?

That decision should be shared by security, legal, and the relevant business owner, because the impact of file access depends on data meaning and obligation, not only technical access. Security supplies the evidence, legal interprets the notification threshold, and the business owner clarifies what the data represents.