When must a data breach be reported to the Finnish Data Protection Ombudsman?

The controller must report a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects. Where the risk is high, the data subjects must also be informed. All breaches must be documented internally.