If a security breach causes unauthorized access, loss, or alteration of personal data, institutions must inform the supervisory authority within 72 hours and possibly affected individuals. Finance companies must deploy breach-alert processes and templates to meet this tight deadline.
