Under the UAE PDPL, a business must notify the UAE Data Office "immediately upon becoming aware" of a data breach that could harm people's privacy or data security — and affected individuals too, where the risk is high. In practice, "immediately" means within 72 hours of discovery: the operative standard per UAE Data Office guidance and the consensus of UAE practitioners. Miss it, and administrative fines run from AED 50,000 to AED 5,000,000 per violation.
This is general information about publicly documented PDPL requirements — not legal advice. For your situation, consult a UAE data-protection lawyer.
What counts as a data breach (and what doesn't)
The PDPL treats a data breach as any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data — the GDPR definition UAE practitioners use (Nour Attorneys, 2026). For a typical UAE business website:
- A hack exposing your customer database or contact-form submissions.
- A misconfigured cloud bucket or backup leaking customer files publicly.
- A bulk email CC'd instead of BCC'd.
- A lost laptop with an unencrypted customer export, or ransomware locking your server.
"Personal data" is anything identifying a person directly or indirectly — names, phone numbers, Emirates IDs, emails, IP addresses, location data (Noura Lawyers, 2026).
Not notifiable: data encrypted or rendered unintelligible so it poses no risk — or where you neutralized the risk — may be exempt from notifying individuals (Noura Lawyers, 2026). The UAE Data Office still gets notified. Encryption is your legal escape hatch.
"Immediately" vs. 72 hours: what the law actually says
Here is the honest version, because published sources disagree.
Article 9 of Federal Decree-Law No. 45 of 2021 — issued 20 September 2021, in force since 2 January 2022 (Pinsent Masons, ~Nov 2025) — requires the controller to notify the UAE Data Office "immediately upon becoming aware" of a breach that would prejudice the privacy, confidentiality, or security of personal data. Exact time limits and procedures, it says, come in the law's executive regulations.
Where practitioners split: Noura Lawyers' 2026 guide says the regulations are Cabinet Decision No. 33 of 2024, in force since 2024, making 72 hours operative. Hadef & Partners (2026, via Lexology) and RecordingLaw's 2026 guide say they have not yet been published — hence the statute's bare word "immediately."
What everyone agrees on:
- 72 hours from awareness is the operative standard — the UAE Data Office's guidance in the regulations' absence (RecordingLaw), "without undue delay, and where feasible, within 72 hours" (Nour Attorneys), the "de facto 72-hour standard" (Arfadia). The GDPR and DIFC/ADGM regimes do too.
- The clock starts at awareness — not when the investigation finishes. Notify first with what you know, then supplement.
- Waiting to be "sure" about the regulations is the riskiest reading. The PDPL is in force and enforcement is increasing. Treat 72 hours as binding.
Who you must notify, and when
Three duties, three audiences.
1. The UAE Data Office — within 72 hours. Where the breach is likely to harm people — reputational, financial, physical, or other harm — the controller notifies the national regulator (Noura Lawyers, 2026). Not enterprise-only: the PDPL covers any entity processing personal data of people in the UAE, wherever the business is established.
2. The affected individuals — without undue delay. Where the breach is likely to result in high risk to people's rights — sensitive data exposed, identity fraud enabled — tell them in clear, plain language: what happened, the likely consequences, what you are doing (Noura Lawyers, 2026). It may be delayed if it would prejudice an ongoing criminal investigation. The encryption/neutralized-risk exemptions relieve the individual duty — never the regulator one.
3. Your processor must tell you — immediately. You (the website owner) are the controller; your hosting provider, form SaaS, email platform, and payment gateway are processors, and Article 9(3) requires them to notify you immediately upon becoming aware of any breach (per published English translations). Write it into your vendor contracts — PDPL-compliant data processing agreements are a core compliance item (Noura Lawyers, 2026). A host that takes days to tell you eats your 72 hours.
Even when no notification is due: every breach goes in an internal breach register — facts, effects, remedial action — including sub-threshold incidents. The register is subject to UAE Data Office inspection (Noura Lawyers, 2026).
What the notification to the Data Office must contain
Article 9 requires a documented report with these contents (per the law's published English translation):
| Required item | What it means in practice |
|---|---|
| Nature, category, reasons, approximate number and records | What happened (e.g. database intrusion), which data types, roughly how many people and records — estimates are fine |
| Details of the appointed Data Protection Officer | DPO contact details, if you have one; otherwise the person responsible for the response |
| Likely consequences for the affected people | Identity theft, phishing, or fraud risk — be specific, not boilerplate |
| Measures taken or proposed | Containment (isolated systems, rotated credentials), mitigation (forced password resets), prevention (patch applied) |
| Documentation of the breach and remedial action | Incident log: detection timeline, findings, actions — fed by the breach register |
| Any other requirements requested by the Office | The Data Office can ask for more; assume the first notice won't be the last |
Practical tip from the developer's side: the notice is only as fast as your logs. If your site keeps detailed access logs, tested backups, and an inventory of what personal data lives where — a technical SEO and security audit covers the logging side — you can fill this table in hours. Nour Attorneys' 2026 guide is blunt: lacking incident-response capability that works under pressure is itself a compliance failure and an aggravating factor.
Penalties: what a late or missed notification costs
Penalties are graduated and land on more than the bank account (Noura Lawyers' 2026 guide; Alhekma Legal Consultancy, 2026):
- AED 50,000 to AED 5,000,000 per violation — gravity, duration, people affected, harm, and intent all weigh. A missed notification on weak security is two violations.
- Repeat violations can double the maximum — sustained non-compliance costs more than a compliance programme.
- Non-financial orders: stop processing, erase data, suspend transfers, publicly disclose the violation.
- Criminal liability, including imprisonment, for intentional sensitive-data violations, confidentiality breaches, or obstructing an investigation.
- Civil claims from harmed individuals through UAE courts, on top of fines — plus parallel exposure under the Cybercrime Law (Federal Decree-Law No. 34 of 2021) (kukie.io, 2026).
The 72-hour incident-response checklist for website owners
Print this, assign names, rehearse yearly — the clock doesn't pause while you figure out who does what.
Hours 0–8: Detect, contain, preserve
- ☐ Confirm the incident — check logs, hosting alerts, customer reports.
- ☐ Contain: isolate systems, rotate credentials, revoke suspicious sessions.
- ☐ Preserve evidence: snapshot logs and server images before cleaning anything.
- ☐ Open the breach register entry with the time of awareness.
Hours 8–24: Assess scope and risk
- ☐ Identify what data was touched — run your data inventory.
- ☐ Estimate affected people and records — rough counts are fine.
- ☐ Grade the risk; sensitive data exposed = high risk.
- ☐ Engage your lawyer; add a forensics/security firm if needed.
Hours 24–48: Draft and decide
- ☐ Draft the Data Office notification from the six items above.
- ☐ Decide on individual notification (high-risk test); draft the plain-language notice.
- ☐ Check the exemptions: encrypted data or neutralized risk may relieve the individual duty — document why.
- ☐ If a vendor caused the breach, get their incident report in writing.
Hours 48–72: Notify
- ☐ File with the UAE Data Office — don't let the clock expire while polishing the wording.
- ☐ Notify affected individuals where required.
- ☐ Keep every timestamp: awareness, containment, filing. Your timeline is your defense.
After 72 hours: Recover and harden
- ☐ Remediate and close the breach register entry with the full timeline and lessons learned.
- ☐ Verify independently. When we build or rebuild business websites, encryption, least-privilege access, and off-site backups are baseline.
The highest-return preparation is a data inventory and a named incident lead. If your site needs the technical foundations — hardened configuration, proper logging, encrypted backups — that's what a professional web development partner in Dubai should deliver as standard.
Breach response is one duty among several the law places on a business website: our UAE PDPL website compliance guide covers the full set — consent, privacy notices, data-subject requests and cross-border transfers — in one place.
Frequently asked questions
Is the 72-hour deadline actually written in the PDPL?
Not in those words. Article 9 says the controller must notify the UAE Data Office "immediately upon becoming aware" of a qualifying breach, leaving exact time limits to the executive regulations. The 72-hour figure is the de facto operative standard — the UAE Data Office's guidance (RecordingLaw, 2026), framed by Nour Attorneys as "without undue delay, and where feasible, within 72 hours." Plan for 72 hours — no UAE practitioner advises a slower timeline.
Am I a "data controller" just because I own a business website?
Almost certainly, if your site collects personal data from people in the UAE — forms, signups, checkout, accounts, even analytics cookies. You decide what is collected and why: that makes you the controller. Your host, form SaaS, email platform, and payment gateway are your processors: under Article 9(3) they must notify you immediately upon becoming aware of a breach — make your contracts require it. The law also reaches foreign companies: it applies to anyone processing data of people in the UAE, regardless of establishment (Noura Lawyers, 2026).
Do I have to email every customer for every small incident?
No. Individuals must be notified only where the breach is likely to result in high risk to their rights — exposed passwords, financial data, identity documents, anything enabling identity fraud. Low-risk incidents go in your breach register. The UAE Data Office is notified where harm is likely — a lower bar. When in doubt, notify: the penalties for silence dwarf the cost of a well-written notice.
What are the actual fines for getting this wrong?
AED 50,000 to AED 5,000,000 per violation (Noura Lawyers, 2026; Alhekma Legal Consultancy, 2026) — gravity, duration, people affected, harm, and intent all weigh; doubled for repeat violations. Beyond fines: orders to stop processing, erase data, or suspend transfers; public disclosure; criminal referral (including imprisonment) for intentional violations; and civil compensation claims through UAE courts.
My company is in a free zone — or outside the UAE. Does the PDPL apply?
It depends on which free zone. DIFC and ADGM companies follow their own data-protection laws (DIFC Law No. 5 of 2020; ADGM Data Protection Regulations 2021), not the federal PDPL (Pinsent Masons, ~Nov 2025; RecordingLaw, 2026). Other UAE free zones generally fall under the PDPL. Outside the UAE but collecting data from people in the UAE? The PDPL's extraterritorial scope brings you in (Noura Lawyers, 2026).
The bottom line
The UAE PDPL's breach-notification rule is simple to state and hard to execute under pressure: notify the UAE Data Office within 72 hours of a harmful breach, tell affected individuals without undue delay where risk is high, log everything in a breach register, and make vendor contracts guarantee processors tell you first. The law has been in force since January 2022; commentary disagrees on the executive regulations, but no serious practitioner treats that as a reason to wait.
Businesses that survive the 72-hour clock prepared before it started: a data inventory, encrypted storage, working backups, proper logging, and a named response owner. This article explains the public requirements as documented by UAE law firms and the statute's published translations — for decisions about your business, get a UAE data-protection lawyer in the room.
