In circumstances where a data breach is likely to "result in a risk for the rights and freedoms of persons," GDPR will make breach reporting mandatory. The notification deadline is 72 hours from the moment you first become aware of a data breach.