**To the supervisory authority:** Within **72 hours** of becoming aware of the breach, unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons" (Article 33). - **To data subjects:** "Without undue delay" when the breach is "likely to result in a high risk to