How quickly must a personal data breach be reported in Sweden?

The notification to the Swedish Authority for Privacy Protection must be made without undue delay and no later than 72 hours after the controller became aware of the breach. A later notification must be accompanied by reasons for the delay. Where the risk to the rights and freedoms of data subjects is unlikely, no notification is needed, but the assessment must be documented. Where the risk is high, the data subjects must also be informed.