The requirement to report certain personal data breaches to the supervisory authority within 72 hours of becoming aware of them (Articles 33–34).