Data-protection incidents in Saudi Arabia

How we help with data-protection incidents

• Evidence and document review

  Our review covers restricted incident summary, affected data categories, relevant access records, processing roles and containment or complaint correspondence. We identify what supports your position and what needs clarification or further evidence.

• When does the Saudi 72-hour personal-data breach notice apply?

  Under implementing Article 24, a controller must notify the competent authority within 72 hours of awareness where the breach could harm personal data or its subject or conflict with the subject’s rights or interests. Record awareness time, affected data, risk and containment. Missing details must follow as soon as possible with reasons for delay. Notification to affected individuals is required without undue delay at the stated harm threshold; other cyber-reporting duties remain separate. Identify the data, processing roles, affected people and facts currently known. Distinguish a suspected event from confirmed access, disclosure, loss or alteration. Preserve a restricted chronology so containment, individual requests and any notification assessment can be handled on an accurate basis.