Personal-data breach response in the UAE

For controllers governed by ADGM’s Data Protection Regulations 2021, notify the Commissioner without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to create a risk to affected individuals. Record awareness, risk assessment and response decisions. This ADGM test is not a UAE-wide or DIFC deadline; separate notification to individuals may also need assessment.

• ADGM: data-protection breach notification FAQ

Article 9 requires reporting qualifying breaches to the UAE Data Office and leaves the period, procedures and requirements to the Executive Regulations. First assess whether the federal law applies, including sector and special-free-zone exclusions, and verify the operative implementing requirements. The statutory text alone does not justify importing a 72-hour deadline from ADGM or the GDPR.

• Federal Personal Data Protection Law, Article 9

Describe the data categories and scale without circulating the leaked dataset. Use a restricted summary first; agree a secure, limited transfer if specific records are needed for the assessment.

Do not assume a universal notification rule or deadline. Identify the controller and processor roles, relevant jurisdictions, affected data and discovery timeline so the applicable duties can be checked promptly. This page does not establish whether your incident is reportable.

Preserve a restricted incident chronology, access and security logs, the affected data categories, processor agreements and records of containment and communications, prepare a dated chronology and identify any notice or deadline. Send those materials to CounselO for an initial assessment of the facts, forum and options in the UAE.

For this problem, start with a restricted incident chronology, access and security logs, the affected data categories, processor agreements and records of containment and communications. Add a short dated summary and identify any notice or deadline. The final list depends on the facts.

Yes. The initial assessment and document review can begin through WhatsApp, email or the consultation form in Arabic or English. Formal filing, attendance and reserved representation work are scoped separately where required in the UAE.

CounselO focuses the review on which personal data may have been accessed, disclosed, lost or changed, which people and systems are affected, and what is known rather than assumed about the incident, checks a restricted incident chronology, access and security logs, the affected data categories, processor agreements and records of containment and communications, identifies the potentially applicable framework and authority, verifies the operative provisions within the agreed scope, and delivers advice directed to whether and how to assess the incident, preserve evidence and establish whether notification, remedial action or a response to affected people is required.

CounselO targets a professional response within 24 hours, subject to the matter’s scope, urgency, intake completeness and service availability. The target is not a guaranteed legal outcome or filing deadline.