Within 72 hours to the Commissioner where there is a risk to people, and to the individuals themselves where the risk is high.
A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. A laptop left in a taxi counts. So does an email sent to the wrong recipient, a misconfigured folder, and a ransomware infection.
Where the breach is likely to result in a risk to people's rights and freedoms, you must notify the Data Protection Commissioner within 72 hours of becoming aware of it. Where the risk is high, you must also tell the affected individuals, without undue delay.
If you cannot assemble every detail within 72 hours, notify anyway and supply the rest afterwards. A late complete report is worse than a prompt partial one.
Every breach must be recorded internally, including those you decide are not notifiable, together with your reasoning. That internal record is the first thing an investigator asks for.