In case there's a breach of personal data, or organization’s data, the one handling the data needs to inform the one in charge of it as soon as they know about it. After that, the person in charge of the data has to tell the consumer reporting agency about the breach within 72 hours.