Article 33(1) requires that notification of a breach be given "without undue delay and, where feasible, not later than 72 hours after having become aware of it." Article 33(5) is more concerned with the documentation process around it. The DPC considered the infringements "to be moderately serious in terms of their gravity" and upped the amount from the previous range in the draft decision ($150,000-$300,000).
