In the event of a data breach, GDPR mandates that companies notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in high risk to the rights and freedoms of individuals, those affected must also be informed without undue delay. Email marketers must have a robust plan in place to handle such situations effectively.