If a data protection incident is likely to result in a risk to the rights and freedoms of natural persons, it must be reported to the data protection authority within 72 hours of becoming known. If ...