How quickly must my company report a personal data breach in the UAE?

Under the UAE PDPL, the data controller must notify the UAE Data Office of a personal-data breach within 72 hours of confirmed assessment ^[1].

What triggers the obligation:

• Any breach of confidentiality, integrity, or availability of personal data — for example, hacking, accidental disclosure, lost laptop, misdirected email, ransomware.
• The clock starts when the controller "becomes aware" of the breach to a reasonable degree of confirmation. Internal investigation time before that point is allowed but should be documented.

What the notification must include:

• Nature of the breach: categories of data, approximate number of data subjects, approximate volume of records.
• Likely consequences and risk assessment.
• Mitigation steps already taken or planned.
• DPO contact details for follow-up.

If the breach is "high risk" to data subjects' rights and freedoms, the controller must also notify each affected data subject without undue delay, in clear plain language, with steps the subject can take.

Processors (vendors handling data on the controller's behalf) must notify the controller without delay; the controller is then responsible for the regulator and data-subject notifications.

For breach response, retain a UAE-licensed data-protection lawyer or DPO advisor to coordinate.