Personal-data breach response in Saudi Arabia

Under implementing Article 24, a controller must notify the competent authority within 72 hours of awareness where the breach could harm personal data or its subject or conflict with the subject’s rights or interests. Record awareness time, affected data, risk and containment. Missing details must follow as soon as possible with reasons for delay. Notification to affected individuals is required without undue delay at the stated harm threshold; other cyber-reporting duties remain separate.

• SDAIA — PDPL Implementing Regulations

Article 37 provides a complaint to the competent authority within 90 days of the incident or learning of it; later acceptance is discretionary where factual reasons prevented timely filing. Identify the controller, time and place, specific conduct and supporting evidence. Retain the original rights request and response where relevant. This administrative complaint is distinct from the controller’s breach notification and does not itself award damages.

• SDAIA — PDPL Implementing Regulations

Describe the data categories and scale without circulating the leaked dataset. Use a restricted summary first; agree a secure, limited transfer if specific records are needed for the assessment.

Do not assume a universal notification rule or deadline. Identify the controller and processor roles, relevant jurisdictions, affected data and discovery timeline so the applicable duties can be checked promptly. This page does not establish whether your incident is reportable.

Preserve a restricted incident chronology, access and security logs, the affected data categories, processor agreements and records of containment and communications, prepare a dated chronology and identify any notice or deadline. Send those materials to CounselO for an initial assessment of the facts, forum and options in Saudi Arabia.

For this problem, start with a restricted incident chronology, access and security logs, the affected data categories, processor agreements and records of containment and communications. Add a short dated summary and identify any notice or deadline. The final list depends on the facts.

Yes. The initial assessment and document review can begin through WhatsApp, email or the consultation form in Arabic or English. Formal filing, attendance and reserved representation work are scoped separately where required in Saudi Arabia.

CounselO focuses the review on which personal data may have been accessed, disclosed, lost or changed, which people and systems are affected, and what is known rather than assumed about the incident, checks a restricted incident chronology, access and security logs, the affected data categories, processor agreements and records of containment and communications, identifies the potentially applicable framework and authority, verifies the operative provisions within the agreed scope, and delivers advice directed to whether and how to assess the incident, preserve evidence and establish whether notification, remedial action or a response to affected people is required.

CounselO targets a professional response within 24 hours, subject to the matter’s scope, urgency, intake completeness and service availability. The target is not a guaranteed legal outcome or filing deadline.