Sounds like GDPR / HFEA / other medical or significant legal body. They often also give nice fat juicy bonuses to people who report problems that get looked into, and if a company self-reports will often overlook issues provided there’s a serious attention to cleaning shit up.