An agency must notify the Commissioner as soon as practicable after becoming aware that a notifiable privacy breach has occurred.