GDPR - Art. 33.1 - Notification of a personal data breach to the supervisory authority "In the case of a personal data breach, the controller shall without und

GDPR - Art. 33.1 - Notification of a personal data breach to the supervisory authority "In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. 2Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay." OK, it's not ALL cybersecurity incident but limited to personal data breach... but the delay is 72h ! So, in a way, it look to me like SEC is only playing catch-up