Notifying the competent authority of a data breach within 72 hours
The implementing regulation of the Personal Data Protection Law requires a controller to notify the competent authority within 72 hours of learning of a breach likely to harm the data subject. The data subject must also be told without unjustified delay.
Who it applies to
A controller that learns of a breach, loss or unauthorised access to data where the harm condition is met.
What the source says
Article 24 of the implementing regulation says a controller notifies the competent authority within 72 hours of learning of a breach, loss or unauthorised access to data, where it is capable of harming the data subject, their rights or interests. The duty to notify originates in article 20 of the law; the number of hours comes from the regulation, not the law.
The notice describes the incident, when and how it happened and when it was discovered; the categories and numbers of data subjects and the type of data; the risks, the measures taken and future measures; whether the data subject was told; and contact details for the controller or its protection officer. If all this cannot be supplied in time, it is provided as soon as possible together with reasons for the delay.
The data subject is informed without unjustified delay, in plain language, with a description of the incident, the risks, the measures and recommendations for avoiding harm.
When it matters to you
If you are an organisation holding client data, write an incident plan before anything happens: who decides the incident matters, who gathers the notice contents, who writes to data subjects. If you are a provider handling an owner's or association's data, know who the controller is in that relationship so your report reaches them quickly.
What this article does not cover
Whether the harm threshold that triggers notification is met has to be judged for each incident, and this article does not decide it. This is general information from a published source, not legal advice; official decisions and procedures take place on the authority's platform.
Key points
- Notify the competent authority within 72 hours of learning of a breach likely to cause harm.
- The duty originates in article 20 of the law; the hours come from article 24 of the regulation.
- The notice has defined content covering description, risks and measures.
- If incomplete, supply the rest later with reasons for the delay.
- Tell the data subject without unjustified delay, in plain language.
Related provisions
- اللائحة التنفيذية لنظام حماية البيانات الشخصية، المادة 24
- نظام حماية البيانات الشخصية، المادة 20