Personal data incidents only need to be reported to the supervising authority if it is probable that the breach creates a risk for people's freedoms and rights. If the incident is not reported, the data controller should motivate and document the decision not to report. If the incident is to be reported, it should normally be done within 72 hours (supplementing information can be submitted thereafter). It is the data controller that should file the incident to the supervising authority.