What Should a UAE Company Do After a Personal Data Breach?

Contain it, work out what personal data was exposed and whose, report it, keep a record and fix the cause. Under Article 9 of the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), a controller that becomes aware of a breach that would prejudice the privacy, confidentiality and security of someone's personal data must report it to the UAE Data Office and must also tell the people affected. The law leaves the deadline to its Executive Regulations, so confirm the current period with your legal adviser instead of relying on a number you read online.

What does the UAE PDPL actually say about reporting a breach?

The Decree-Law has been in force since 2 January 2022. The official text on the UAE government portal, u.ae, is published in Arabic, and the portal notes that the document is available in Arabic only. The wording below is our English translation of Article 9, headed "Reporting a personal data breach", so have your legal adviser check it against the Arabic before you rely on it.

• Article 9(1), the regulator. As soon as the controller becomes aware of any breach or violation of a data subject's personal data that would prejudice the privacy, confidentiality and security of that data, it must report the breach and the results of its investigation to the UAE Data Office, within the period and under the procedures and conditions set by the Executive Regulations.
• Article 9(2), the people affected. In all cases, the controller must notify the data subject where the breach would prejudice the privacy, confidentiality and security of their personal data, within the period and under the procedures set by the Executive Regulations, and tell them what measures it has taken.
• Article 9(3), your suppliers. A processor that becomes aware of a breach must notify the controller immediately, so that the controller can report it to the Data Office.
• Article 9(4), what the regulator does. After receiving the report, the Data Office verifies the causes of the breach to check the soundness of the security measures taken, and imposes administrative penalties where a violation is proven.

What does the official text leave open?

Three questions the Decree-Law does not answer by itself, and each one matters on the day:

• The deadline. Article 9 does not state a number of hours or days for either report. It hands the period to the Executive Regulations, which Article 28 required the Cabinet to issue within six months of the Decree-Law being issued. Ask your legal adviser whether regulations setting that period are in force and what they say. ADGM's rules include a 72-hour limit where feasible, as explained below, but that figure does not appear in Article 9.
• The threshold. The test is a breach that would prejudice privacy, confidentiality and security. How the Data Office applies that to, say, an email sent to the wrong person or a lost laptop that was encrypted is a question for your adviser, not a guess to make under pressure.
• Whether the PDPL covers you. Article 2 lists what the Decree-Law does not apply to, including government data, health personal data that has its own legislation, banking and credit personal data that has its own legislation, and companies located in the UAE's free zones that have their own personal data protection legislation. The DIFC and ADGM both have such legislation, covered below.

What should you do in the first hours?

Stop the loss without destroying the evidence you will need for the report.

• Start a timed log. Record when the breach was found, by whom, and every action after that. Article 9(1) is triggered when the controller becomes aware, so a precise record of who knew what, and when, will matter.
• Cut off access. If a Microsoft 365 account is involved, disable it and revoke its sessions in Microsoft Entra ID. Microsoft notes that there can be a gap between starting revocation and access actually ending, and that session tokens issued by other applications have to be revoked by those applications.
• Isolate devices, do not wipe them. Rebuilding a laptop or server before anyone has examined it can destroy the evidence of what was taken.
• Save the logs. Microsoft 365 keeps audit records for 180 days for users without an E5 licence or E5 audit add-on, so search and export the records for affected accounts early.
• Bring in the right people. Your IT provider or an incident response team, your legal adviser, and the person with authority to sign off a report to the regulator.

How do you work out what was exposed?

Article 9(1) lists what must accompany the report to the Data Office. In our translation, that is:

• The nature, form and causes of the breach, the approximate number involved and its records.
• The details of the data protection officer the controller has appointed.
• The potential and expected effects of the breach.
• The actions and measures taken, and those proposed, to deal with the breach and reduce its negative effects.
• Documentation of the breach and of the corrective actions taken.
• Any other requirements the Data Office asks for.

That list doubles as your assessment checklist. Work through which systems and accounts were involved, which kinds of personal data they hold (contact details, ID copies, payroll records, health information), roughly how many people are affected, whether the data was encrypted, whether it was viewed or copied out, and whether the attacker still has access. Write down what you know and what you do not know yet, with the time of each finding. A clear "not yet known" is easier to defend than a guess you later have to correct.

Who else might you have to tell?

If your company is in the DIFC or ADGM, their own rules decide who you report to and when:

• DIFC. The DIFC Data Protection Law No. 5 of 2020 applies in the jurisdiction of the DIFC. Under Article 41, when a breach compromises a data subject's confidentiality, security or privacy, the controller notifies the Commissioner of Data Protection "as soon as practicable in the circumstances", and a processor notifies the controller without undue delay. Under Article 42, affected individuals must be told as soon as practicable when the breach is likely to result in a high risk to their security or rights, and promptly if there is an immediate risk of damage. The Commissioner's online form is submitted through the DIFC Portal and is not shared with individuals, so you notify them separately.
• ADGM. ADGM's Office of Data Protection states that under Article 32 of its Data Protection Regulations 2021, controllers must notify it "without undue delay and, where feasible, not later than 72 hours after becoming aware" of a breach. Reports are made through ADGM's Online Registry Solution.

Beyond the regulators, check three more lists: customers whose contracts require notice of a breach, your cyber insurer if you have a policy, and suppliers that process the same data. Where a supplier is your processor, Article 9(3) of the PDPL requires it to tell you immediately, so your contract should say how and to whom.

What should you record, and what happens afterwards?

Keep one incident file from the first hour. The PDPL report must include documentation of the breach and the corrective actions taken. In the DIFC, Article 41(6) goes further: the controller documents in writing any personal data breach, with its facts, effects and remedial action, and makes the record available to the Commissioner on request. In the DIFC that covers breaches you decided not to report, so record your reasoning too.

Then hold a review while memories are fresh:

• How did the attacker or the error get in, and is that route closed?
• How long did detection take, and what would have shown it sooner?
• Who decided whether to report, and how long did that decision take?
• Which changes go into the plan, the supplier contracts and the technical controls, and who owns each one?

If the breach came with ransomware, our ransomware protection playbook covers containment and recovery in more depth.

What should be in place before a breach happens?

Each of these is quick to settle in a calm week and slow to settle during an incident:

• A named person who decides whether a breach is reportable, a deputy, and a written definition of when the company counts as aware.
• A contact sheet kept outside your main systems: legal adviser, IT provider, insurer and each regulator's reporting channel.
• Draft reports and notices to individuals, built around the Article 9(1) items.
• Audit logging switched on, records kept long enough to investigate, and a tested way to disable accounts and revoke sessions.
• Supplier contracts that set out how processors report a breach to you.
• A rehearsal with the people who would actually respond.

Our breach notification readiness work maps the notification obligations that apply to you and drafts the templates, and our incident response plan service covers the wider plan. On every GR IT AMC and GR Managed IT package, P1 incidents are answered in 5 minutes, 24/7. To prepare, or if you are dealing with a breach now, contact us.