In case of hacking, you must inform within 72 hours all parties involved in the data capture, in the following order:
1- The supervisory authority
2- The data controller
3- The final consumer