In the case of a personal data breach, the controller shall notify without undue delay and, where feasible, not later than 72 hours after having become aware of it, the personal data breach to the European Data Protection Supervisor, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
I gcás sárú i ndáil le sonraí pearsanta, déanfaidh an rialaitheoir, gan aon mhoill mhíchuí agus, más féidir, tráth nach déanaí ná 72 uair an chloig tar éis dó a bheith ar an eolas faoin sárú sin, fógra a thabhairt don Mhaoirseoir Eorpach ar Chosaint Sonraí, ach amháin nuair nach dócha go mbeidh riosca ann do chearta agus do shaoirsí daoine nádúrtha mar thoradh ar an sárú i ndáil le sonraí pearsanta.