(85) In the absence of an adequate and prompt response, a personal data breach can result in physical harm, property damage or non-property damage to individuals, such as loss of control over their own personal data or restriction of rights, discrimination, identity theft or forgery, financial loss, unauthorized reversal of pseudonymization, damage to reputation, breach of confidentiality of personal data protected by professional secrecy, or any other significant economic or social damage. Therefore, as soon as a personal data breach is discovered, the controller should report it to the supervisory authority without undue delay, if feasible, no later than 72 hours after the breach is discovered, unless the controller can demonstrate in accordance with the principle of accountability that the breach is unlikely to result in a risk of violation of the rights or freedoms of individuals. If the notification cannot be made within 72 hours, the notification should be accompanied by an explanation of the reasons for the delay, and the information may be provided gradually, without further undue delay.