To which entity merchants must report credit card breach?

In the incident that a Marchand like Target or Home Depot, detects credit cards are breached, who they need to notify? Visa recommends informing the merchant bank, and/or Visa Incident Response Manager.

Here, it says: There may be circumstances where notification to individual by a third party is more appropriate. For example, in the event of a breach by a retail merchant of credit card information, the credit card issuer may be involved in providing the notice since the merchant may not have the necessary contact information.

Besides notifying the bank and credit card issuer, who the merchants must notify in the event of credit card data breach? Should they send notice directly to individuals?