You have to report any personal data breach to the relevant data protection authority. You have to notify the relevant supervisory authority about the incident within 72 hours from the moment you become aware of it, so not from the moment the incident occurred. In more serious cases, apart from notifying the data protection authority, you must also inform the individuals whose data have been affected by the incident.