What it asks for. When a personal data breach occurs, the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. Processors must inform the controller without undue delay. All breaches must be documented, whether or not they are notified.
In practice. Organisations have a breach procedure that links security incident response to data protection assessment, with clear roles for deciding whether notification is required. The notification describes the nature of the breach, likely consequences, measures taken and a contact point, and can be provided in phases. Evidence includes an internal breach register, decision records and processor contracts that require prompt reporting.
Common gaps. The clock is often misunderstood or started late because security and privacy teams work separately. Breaches judged not notifiable are frequently left undocumented.