We know that when a personal data breach occurs, the data controller (Controller) must notify the Supervisory Authority within 72 hours, without…

Explanation:

Article 33 which deals with “Notification of a personal data breach to the supervisory authority” in its

paragraph 1 legislates:

1. In the case of a personal data breach, the controller shall without undue delay and, where feasible,

not later than 72 hours after having become aware of it, notify the personal data breach to the

supervisory authority competent in accordance with Article 55, unless the personal data breach is

unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the

supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.