Only data subjects who have had a significant risk to their rights and freedoms warrant notification of the data breach without undue delay according to GDPR. Controllers must inform the affected data subjects of the facts relating to the breach, its effects and any remedial action taken.