An organization within the European Union experienced a data breach. During the breach, personally identifiable data was stolen by the attackers. Under which regulation is this organization required to notify the applicable government agencies of the breach within 72 hours?