Data controllers must notify a personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware unless the breach is unlikely to result in a risk to the rights and freedoms of natural person. If a delay beyond 72 hours occurs, the controller must notify the Data Protection Authority of the reason for the delay.