Alphonse is an information security manager working for a training corporation located in France. Alphonse is responsible for the Security Operations Center (SOC). He has just been advised by one of the technicians that they received an alert that is an Indication Of Compromise (IoC). At first glance, it appears that a bad actor has been able to gain access to their database of student information. Under the European Union's (EU) General Data Protection Regulation (GDPR) there is a notification requirement. How long does a data controller have to notify the applicable government agency after a data breach or leak of personal or private information and when does the clock start?