Notification to users is required by article 34, not 33: https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/ There is no 72h requirement, but "

Notification to users is required by article 34, not 33: https://gdpr-info.eu/art-34-gdpr/ https://gdpr-info.eu/art-34-gdpr/ There is no 72h requirement, but "the controller shall communicate the personal data breach to the data subject without undue delay"