UAE PDPL Breach Notification: What to File and When

The honest starting point: the UAE PDPL's breach rule is written, in force, and specific about what you file — but deliberately vague about when, because the timing was pushed into Executive Regulations that we cannot confirm as published on any official UAE source. That gap shapes everything below.

What does the PDPL actually require, and where is it written?#

The obligation lives in Article 9 of Federal Decree-Law No. 45 of 2021. The controller shall, immediately upon becoming aware of any infringement or breach of the personal data of the data subject that would prejudice the privacy, confidentiality and security of such data, report the breach and the results of the investigation to the Office within such period and in accordance with such procedures and conditions as set by the Executive Regulations.

Read that carefully. The trigger is a breach that would prejudice the privacy, confidentiality and security of the data — a risk threshold, not every incident. The verb is "immediately." And the precise period, procedures and forms were handed to Executive Regulations.

The processor sits in the chain too. The processor shall, immediately upon becoming aware of any infringement or breach of the personal data of the data subject, notify the controller of such breach in order for the controller, in turn, to report it to the Office. So the processor's duty runs to your controller, not to the regulator directly — which is why your processor contracts need an explicit, fast notification clause.

After you report, the regulator does not just file it. The Office shall verify the causes of the breach to ascertain the integrity of the security measures taken. In other words, your notification opens an assessment of whether your controls were adequate in the first place.

Who does this actually apply to?#

The PDPL reaches broadly by design. It applies to the processing of personal data by any data controller or data processor located in the UAE processing the personal data of data subjects residing or working within or outside the UAE.

Two carve-outs matter for breach planning. First, sectoral data is excluded. The PDPL does not apply to types of data for which other legislation is in place, including government data, personal data held by security and judicial authorities, personal health data, or personal financial data. Financial institutions, for instance, face separate breach duties — Licensed Financial Institutions must notify the CBUAE of significant breaches and must notify consumers without undue delay where a breach may pose a risk to their financial and personal security.

Second, the free zones run their own regimes. If you sit in DIFC or ADGM, the federal PDPL is not your instrument.

What exactly do you file?#

The content of the notification is the part the law is clearest about. Pull these together before you sit down to draft, because assembling them is what eats the clock.

Based on the PDPL and the way the Office is expected to assess it, the notification should include:

• A description of the nature, form and cause of the breach.
• The approximate number of affected records and data subjects. The breach notification to the UAE Data Office must include a description of the nature of the breach and the categories and approximate number of affected data subjects.
• The likely consequences, and the measures and remedial action taken. The controller must observe the nature, category, reasons and approximate number of data breach records, a description of the likely consequences, and a description of the measures and remedial action taken.
• Contact details for your DPO or responsible person.
• Supporting documentation, and documentation of the data breach and any other requirements requested by the Office.

This maps almost exactly onto the GDPR Article 33 content set and the DIFC form, so if you already run a GDPR-style breach template you are most of the way there. The DIFC list is a useful checklist to borrow: a description of the nature of the breach including the categories and approximate number of data subjects and records concerned; the name and contact details of the DPO or other contact point; a description of the likely consequences; and the measures taken or proposed to address it.

And you do not have to have everything perfect before you file. Where it is not possible to provide all the information at the same time, it may be provided in phases, as it becomes available. An initial notification that flags "scope still under investigation" is better than a late, complete one.

When is the clock — and why is the answer unsatisfying?#

Here is where you need to hold two facts at once.

The primary law says "immediately." The specific number does not exist in the verified text. The Executive Regulations that would set it have been outstanding for years — they were due within six months of the PDPL's issuance, but as of early 2025 had not been published. More recent primary-source checking reached the same conclusion: the Executive Regulations could not be found on the UAE Legislation portal, whose entry for Federal Decree-Law No. 45 of 2021 lists no related legislation, nor on the UAE Government portal's data protection page; several commercial sites cite specific Cabinet decision numbers as the implementing regulations, but those could not be verified against an official source.

So when a compliance vendor tells you "72 hours, Article 11," treat it as a sensible operating assumption imported from neighbouring regimes, not verified UAE federal law. The 72-hour figure is real and verifiable next door: under Article 32(1) of the ADGM Data Protection Regulations 2021, the data controller must inform the Commissioner without undue delay, and where feasible not later than 72 hours after becoming aware.

The practical takeaway is that "immediately" is arguably stricter than 72 hours, not looser. Run to the tighter standard.

What should Gulf operators do now?#

The uncertainty is not an excuse to wait. The obligation is live, and enforcement posture is tightening.

Two final points. Employee data counts — the PDPL applies to all personal data of natural persons, including employees, so a breach of names, Emirates IDs, salary or health information triggers the same obligations as a customer-data breach. And the reason to get this right is not hypothetical: the UAE Data Office has escalated enforcement activity from 2025 onward — investigating complaints, issuing fines and publishing enforcement notices — with breach notification and technical security measures among the primary focus areas.

Because the timing rule and penalty schedule still depend on regulations we cannot confirm are published, do not rely on any specific deadline or fine figure from a secondary source. Verify the current position with the UAE Data Office, and treat "immediately" as your working standard until an official timeframe is confirmed.

If you want your breach runbook, processor clauses and jurisdiction mapping reviewed against the PDPL as it actually stands today — not as blog posts describe it — book a consultation with the Solas Security compliance team.