If you are a data controller, you must report a breach of the GDPR to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.