We had a data breach. Whom must we notify under GDPR and how fast?

Kort svar ur källan

1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.

GDPR Article 33, EUR-Lex