An Unforeseen Power Outage Results in Company Z's Lack of Access

An unforeseen power outage results in company Z's lack of access to customer data for six hours. According to article 32 of the GDPR, this is considered a breach. Based on the WP 29's February, 2018 guidance, company Z should do which of the following?

A) Notify affected individuals that their data was unavailable for a period of time.
B) Document the loss of availability to demonstrate accountability
C) Notify the supervisory authority about the loss of availability
D) Conduct a thorough audit of all security systems