72 hours from the moment the company becomes aware of the data breach.