According to the GDPR, in the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent, but do you know what is a data breach ?
If you want to know what is a personal data, please check this article :