When must a personal data breach be reported to the Danish Data Protection Agency?

The controller must report the breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects. Where the risk is high the data subjects must also be informed. Every breach must be documented internally, including those that are not reported.