Incidents and Breaches

Not every one. Reporting to the UODO is the rule, from which one can only deviate based on a documented risk assessment for data subjects. The 72-hour deadline runs from the discovery of the breach, and notifying data subjects is a separate decision.