UK GDPR and the Data Protection Act 2018
Organisations must protect personal data with appropriate security measures. If a personal data breach is likely to put people's rights at risk, it must be reported to the Information Commissioner's Office (ICO) without undue delay and within 72 hours of becoming aware of it, where feasible.
Source: ICO: security; ICO: report a breach