Article 33: Notification of a personal data breach to the supervisory authority