Once a company becomes aware of a personal data breach, the clock starts ticking: it must notify the supervisory authority within 72 hours wherever feasible.