2. The data controller may extend the seventy-two-hour period in sub-article 1 to accommodate the legitimate needs of law enforcement or as reasonably necessary to implement measures required to determine the scope of the breach. 3. If the data controller extends the period in accordance with sub-article 2, it shall inform the Authority of the grounds for such extension, including supporting evidence, within the seventy-two hour-period required in subarticle 1. 4. Subject to sub-article 5, when a personal data breach is likely to result in a high risk to the rights and freedoms of a data subject, the data controller shall also communicate the personal data breach to each affected data subject without undue delay in plain and clear language. 5. If a direct communication to the data subject under sub-article 4 would involve disproportionate effort or expense or is otherwise not feasible, the data controller may instead inform data subjects through one or more widely-used media sources. 6. In evaluating risk to the rights and freedoms of a data subject under subarticle 4, the data controller shall take into account: a) the likely effectiveness of any technical and administrative measures implemented to mitigate the likely harm resulting from the personal data breach; b) any subsequent measures taken to mitigate such risk; and c) the nature, scope and sensitivity of the personal data and vulnerability of data subjects involved. 7. The Authority may at any time make a public communication about a personal data breach if it considers the communications made by a data controller to data subjects under sub-article 4 inadequate. Article 26: Contents of data breach notifications and communications 1. The personal data breach notifications and communications required to be made by a data controller under article 25 shall: a) set out the nature of the personal data breach including, where possible, the categories and approximate numbers of data subjects and personal data records concerned; b) communicate the name and contact details of a point of contact of the data controller where more information can be obtained; c) describe the likely consequences to affected data subjects of the personal data breach; 20