We value your privacy

We use cookies to analyse site traffic and improve your experience. You can accept all cookies or reject non-essential ones. See our Privacy Policy for details.

GR IT SERVICES
  • Contact
Get a quote
  2. Compliance
  3. Breach notification readiness
Breach notification, UAE

The 72 hour clock starts when you become aware, not when you finish investigating.

GDPR requires notification without undue delay and where feasible within 72 hours of becoming aware. NIS2 requires an early warning within 24 hours. Organisations lose most of that time deciding who is allowed to decide.

Book a notification readiness reviewSee the clocks
Data breach notification readiness for UAE organisations
  • 72 hoursGDPR supervisory authority notification
  • 24 hoursNIS2 early warning for significant incidents
  • 4 contentsRequired in a GDPR breach notification
  • High riskThe threshold for telling data subjects
Where the hours actually go

Most of the 72 hours is spent deciding who decides.

In the incidents we review, the technical facts were usually known within the first several hours. The delay came from everything around them.

  • Nobody had defined what becoming aware means for the organisation. A support engineer knew at 20:00, a manager knew at 09:00 the next day, and the legal team was told two days later. Each of those is arguable as the start of the clock, which is precisely the problem.
  • Nobody had authority to declare a breach. The decision waited for a person who was travelling, or for a committee that meets on Tuesdays, or for external counsel who needed a purchase order raised before they could be instructed.
  • The notification content had never been drafted. The four required elements were assembled from scratch under time pressure by people who had not read Article 33 before that morning, and the first draft had to be substantially rewritten.
  • And the parallel obligations were discovered late. A single incident can engage a data protection notification, a sector regulator, a NIS2 early warning at 24 hours, contractual notification duties to customers, and an insurer notification condition.
Ask us to run the clock exercise
What the obligations require

Eight things that decide whether you can meet the deadline.

Breach notification failures are almost never technical. They happen because nobody had decided in advance who declares a breach, what counts as becoming aware, or who signs the notification at two in the morning on a Friday.

Awareness starts the clock, not certainty

Notification is required without undue delay and, where feasible, not later than 72 hours after having become aware of the breach. Waiting for a complete investigation before starting the clock is the single most common and most expensive misreading.

Late notification requires an explanation

Where notification is not made within 72 hours it must be accompanied by reasons for the delay. That is a workable provision and it puts your reasoning in front of the regulator, so those reasons need to be better than an internal approval bottleneck.

Four things the notification must contain

The nature of the breach including where possible the categories and approximate number of data subjects concerned, the contact point for more information, the likely consequences, and the measures taken or proposed to address it.

Notification can be phased

Where it is not possible to provide all the information at the same time, it may be provided in phases without undue further delay. That provision exists so that incomplete information is not a reason to miss the deadline entirely.

High risk triggers telling the people affected

Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller communicates it to the data subject without undue delay, describing the nature of the breach in clear and plain language.

Encryption can remove that obligation

Communication to data subjects is not required where appropriate technical and organisational protection measures were applied, in particular those that render the personal data unintelligible. That is a concrete reason to encrypt before an incident rather than after.

Processors notify controllers, without a clock

The processor shall notify the controller without undue delay after becoming aware of a personal data breach. There is no fixed hour figure, and in practice the controller 72 hour window means without undue delay has to mean hours rather than days.

Other regimes run different clocks in parallel

NIS2 requires an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. DORA requires an initial notification, an intermediate report and a final report. One incident can trigger several at once.

Parallel clocks

One incident, several regimes, different deadlines.

Which of these apply depends on your business and your customers. Several UAE organisations are exposed to more than one without having mapped them together.
ObligationTriggerTiming
GDPR supervisory authorityPersonal data breachWithout undue delay, where feasible within 72 hours
GDPR data subjectsLikely high risk to rights and freedomsWithout undue delay
GDPR processor to controllerBecoming aware of a breachWithout undue delay
NIS2 early warningSignificant incidentWithin 24 hours of becoming aware
NIS2 incident notificationSignificant incidentWithin 72 hours of becoming aware
NIS2 final reportSignificant incidentWithin one month of the notification
NIS2 service recipientsLikely adverse effect on servicesWithout undue delay
DORA initial notificationMajor ICT-related incidentTime limits set under Article 20
DORA intermediate reportStatus changed significantlyOn that change
DORA final reportRoot cause analysis completeOn completion
How we approach it

Four things that protect the deadline.

The work is about removing decisions from the incident. Every decision taken in advance is time returned to the investigation.

We define awareness before an incident defines it for you

The clock runs from becoming aware, and organisations without a written definition end up arguing about it retrospectively with a regulator. Deciding what awareness means, and who holds it, is the single highest value hour in this work.

We name deputies, not just owners

Breaches do not respect annual leave. A declaration authority with no named deputy is a single point of failure on the most time critical decision your organisation will make, and it fails at exactly the moments that matter most.

We draft the notification content in advance

The four required elements are known, and most of the structure can be written before there is anything to report. Drafting under time pressure with people who have not read the Article before produces a document that has to be rewritten.

We reconcile the parallel clocks

A single incident can engage a data protection notification at 72 hours, a NIS2 early warning at 24, contractual duties to customers, and an insurance condition. Discovering the shortest of those during the incident is how deadlines get missed.

How an engagement runs

Three phases across roughly four to six weeks.

This is deliberately short. The deliverable is a decision structure and a set of drafts, not a lengthy document nobody reads under pressure.
  1. 01
    Weeks 1 to 2

    Map the obligations that apply to you

    Which regimes reach your organisation, through which customers, in which jurisdictions, and what each requires. A single incident can engage several, and they are far easier to reconcile before an incident than during one.

    • Applicable notification obligations documented
    • Contractual notification duties extracted from customer contracts
    • Insurer notification conditions identified
    • Regulator contact points established in advance
  2. 02
    Weeks 3 to 4

    Define awareness, authority and thresholds

    What constitutes becoming aware for your organisation, who is authorised to declare a breach, who assesses likely high risk to rights and freedoms, and how those people are reached outside working hours without a search for phone numbers.

    • Definition of awareness agreed and published internally
    • Declaration authority assigned with named deputies
    • High risk assessment method documented
    • Out of hours contact chain tested
  3. 03
    Weeks 5 to 6

    Draft, rehearse, correct

    Notification templates covering the four required elements, a data subject communication in clear and plain language, and a timed exercise against a realistic scenario. The exercise reliably finds the two or three things the plan got wrong.

    • Notification templates drafted per obligation
    • Data subject communication drafted in plain language
    • Timed exercise run against a realistic scenario
    • Plan corrected against what the exercise found
Where this comes up

Six situations that make readiness urgent.

The trigger is often somebody else incident rather than your own, which is the cheapest possible way to learn the lesson.

A UAE business with European customers

GDPR reaches organisations outside the Union that offer goods or services to data subjects there. The 72 hour notification obligation comes with that, and it applies whether or not anybody in the organisation has read the Regulation.

A processor serving multiple controllers

The processor must notify the controller without undue delay after becoming aware. With several controllers and a shared platform, that means several simultaneous notifications, each feeding a separate 72 hour clock you do not control.

A financial services firm or its supplier

DORA requires an initial notification, an intermediate report when the status changes significantly, and a final report after root cause analysis. Suppliers feed that process and their contracts usually commit them to assisting with it.

A consumer business holding customer records

Where a breach is likely to result in high risk, data subjects must be told in clear and plain language. For a consumer brand that is a public event, which is why the encryption exception is worth engineering for in advance.

An organisation that missed a deadline before

Late notification must be accompanied by reasons for the delay. Having already given reasons once, the tolerance for a second occurrence is considerably lower, and readiness work after the first incident is usually funded without argument.

A board asking what happens on the night

The honest answer in most organisations is that a small number of people would work it out. A documented and rehearsed structure converts that into a process, which is what a board, an insurer and a regulator are each asking about.

Three positions

How UAE organisations stand when a breach happens.

The middle column is the most common and it is the one that produces a late notification with reasons for the delay that read poorly to a regulator.
Awareness defined in writing
Rehearsed and pre-decidedYes
Documented but untestedVaguely
ImprovisedNo
Declaration authority named
Rehearsed and pre-decidedWith deputies
Documented but untestedOne person
ImprovisedUnclear
Out of hours chain tested
Rehearsed and pre-decidedYes
Documented but untestedNo
ImprovisedNo
Notification templates ready
Rehearsed and pre-decidedYes
Documented but untestedSometimes
ImprovisedNo
Parallel obligations mapped
Rehearsed and pre-decidedYes
Documented but untestedPartly
ImprovisedDiscovered late
High risk assessment method
Rehearsed and pre-decidedDocumented
Documented but untestedAd hoc
ImprovisedNone
Likely outcome on the 72 hours
Rehearsed and pre-decidedMet
Documented but untestedTight or missed
ImprovisedMissed
Quality of the notification
Rehearsed and pre-decidedComplete
Documented but untestedThin
ImprovisedRequires follow up
Regulator impression
Rehearsed and pre-decidedControlled
Documented but untestedDisorganised
ImprovisedConcerning
Effort to reach
Rehearsed and pre-decidedWeeks
Documented but untestedDays
ImprovisedNone
Feature
Rehearsed and pre-decided
Documented but untested
Improvised
Awareness defined in writing
YesVaguelyNo
Declaration authority named
With deputiesOne personUnclear
Out of hours chain tested
YesNoNo
Notification templates ready
YesSometimesNo
Parallel obligations mapped
YesPartlyDiscovered late
High risk assessment method
DocumentedAd hocNone
Likely outcome on the 72 hours
MetTight or missedMissed
Quality of the notification
CompleteThinRequires follow up
Regulator impression
ControlledDisorganisedConcerning
Effort to reach
WeeksDaysNone
The exceptions worth knowing before you need them

Three circumstances remove the obligation to tell data subjects.

Communication to data subjects is the most damaging and most expensive part of a breach response. The published exceptions are narrow and specific, and two of them can be earned in advance.

  • Where the controller has implemented appropriate technical and organisational protection measures, in particular those that render the personal data unintelligible to any person not authorised to access it, and those measures were applied to the data affected by the breach.
  • Where the controller has taken subsequent measures ensuring that the high risk to rights and freedoms is no longer likely to materialise. That is an action taken after the breach, and it has to genuinely remove the risk rather than reduce it somewhat.
  • Where communication would involve disproportionate effort. In that case there must instead be a public communication or a similar measure whereby the data subjects are informed in an equally effective manner, so it is a change of method rather than an escape.
  • The first of those is the one to plan around. Encryption applied to data at rest and in transit, with keys held separately, is a control that pays for itself precisely once, in the incident where it removes a mass notification obligation entirely.
Ask us to check your encryption position
How an engagement runs

Five steps, all aimed at removing decisions from the incident.

Nothing here is technically difficult. It is difficult because it requires decisions from people who are hard to gather when nothing is on fire.
  1. 1

    Map every notification obligation that reaches you

    Data protection, sector regulation through NIS2 or DORA where applicable, contractual duties owed to customers, and insurance conditions. Each has its own trigger and its own clock, and the shortest one governs how the first hours must be spent.

  2. 2

    Define becoming aware and who holds it

    A written definition, applied consistently, with the roles that can hold awareness identified. This is the provision that decides when your 72 hours started, and it should not be reconstructed retrospectively under regulatory scrutiny.

  3. 3

    Assign declaration authority with deputies

    Named individuals who can declare a breach, assess whether it is likely to result in high risk to rights and freedoms, and authorise a notification. Deputies are part of the deliverable rather than an afterthought.

  4. 4

    Draft the content in advance

    Templates covering the nature of the breach with approximate numbers, the contact point, the likely consequences and the measures taken or proposed. Plus a plain language data subject communication, since that one is the hardest to write quickly.

  5. 5

    Rehearse against the clock

    A timed exercise with a realistic scenario, run against the actual deadlines rather than discussed around a table. It reliably finds two or three broken assumptions, which is exactly what it is for.

Straight answers

What organisations ask about breach notification.

On becoming aware of the breach. The obligation is to notify without undue delay and, where feasible, not later than 72 hours after having become aware, which means the clock does not wait for the investigation to conclude.

Notify anyway. The information may be provided in phases without undue further delay where it is not possible to provide it all at once, which exists precisely so that incomplete facts are not a reason to miss the deadline.

The notification must be accompanied by reasons for the delay. That is workable where the reasons are genuinely about the nature of the incident, and considerably less comfortable where the reason was an internal approval bottleneck.

Four elements: the nature of the breach including where possible the categories and approximate number of data subjects concerned, the contact point for further information, the likely consequences, and the measures taken or proposed to address it.

Where the breach is likely to result in a high risk to the rights and freedoms of natural persons. The communication must describe the nature of the breach in clear and plain language and include several of the same elements as the regulator notification.

It can. Communication is not required where the controller had implemented appropriate technical and organisational protection measures, in particular those rendering the personal data unintelligible, and those measures were applied to the affected data.

Where the controller has taken subsequent measures ensuring the high risk is no longer likely to materialise, and where communication would involve disproportionate effort, in which case there must instead be a public communication or similar measure that informs data subjects equally effectively.

To notify the controller without undue delay after becoming aware of a personal data breach. There is no stated hour figure, but since the controller has 72 hours from their own awareness, without undue delay has to be read as hours.

Yes. Controllers must document any personal data breaches, comprising the facts relating to the breach, its effects and the remedial action taken. That documentation is what a supervisory authority uses to verify compliance with the obligation.

They are tighter at the start. An early warning is due within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, and a final report within one month of that notification. Service recipients must also be told.

It requires reporting major ICT-related incidents through an initial notification, an intermediate report as soon as the status has changed significantly, and a final report once root cause analysis is complete, with time limits set under Article 20.

Regularly, and that is the main planning difficulty. A single event can engage a data protection notification, a sector regulator, contractual duties to customers, and an insurance condition, each with different triggers, contents and deadlines.

Someone senior enough to make the call and reachable enough to actually make it, with named deputies. The most common failure is a single authority who is unavailable, which converts a decision into a wait at the worst possible time.

A timed one, yes. Discussing a scenario around a table finds gaps in reasoning. Running it against real clocks finds gaps in execution, which are the ones that cause a missed deadline, and they are rarely visible any other way.

We scope by how many obligations apply and how many jurisdictions are involved. The free first step: ask who in your organisation is allowed to declare a personal data breach, and what happens if that person is on a plane.

No. The obligation attaches to a personal data breach, and the data subject communication obligation attaches only where the breach is likely to result in a high risk to rights and freedoms. Assessing that quickly is exactly what the readiness work enables.

Uncertainty does not stop the clock, which is why phased notification exists. The information may be provided in phases without undue further delay, so an initial notification describing what is known is preferable to silence while you investigate.

Somebody who can write plainly, reviewed by legal. The requirement is to describe the nature of the breach in clear and plain language, and communications drafted entirely by lawyers or entirely by marketing tend to fail that test in opposite directions.

They are separate obligations running in parallel rather than in sequence. NIS2 requires notifying service recipients without undue delay where significant incidents are likely to adversely affect service provision, alongside the regulatory reporting.

The facts relating to the breach, its effects and the remedial action taken. That documentation obligation covers any personal data breach, and it is what a supervisory authority uses to verify that non reporting decisions were reasonable.

Their notification to you starts your assessment, and your contract should define how quickly that reaches you and in what form. Where a processor notifies a controller without undue delay, without undue delay has to mean hours given the controller own deadline.

Policies commonly require notification within a defined period, and that period is sometimes shorter than the regulatory ones. Mapping it alongside the regulatory clocks is part of the readiness work rather than something to look up during an incident.

A realistic scenario, run against real clocks, with the actual people who would be involved rather than their deputies. It should produce two or three corrections to the plan, and an exercise that produces none was probably too comfortable.
Readiness check

Fifteen questions to answer before an incident.

Every one of these is answerable in a calm afternoon and expensive to answer during an incident. That contrast is the entire argument for doing this work.

The clock

  • What does becoming aware mean here?
    Define it in writing.
  • Who can declare a breach?
    And who deputises.
  • How are they reached at 3am?
    Test the chain.
  • Who assesses high risk?
    It decides data subject notification.
  • Who signs the notification?
    Decide before, not during.

The content

  • Do we have a template?
    Covering the four elements.
  • Can we estimate affected data subjects?
    Approximate is acceptable.
  • Can we describe likely consequences?
    A required element.
  • Is there a plain language draft?
    For data subjects.
  • Do we document every breach?
    Including unreported ones.

The parallel duties

  • Which customers require notification?
    Check the contracts.
  • Does NIS2 or DORA apply through anybody?
    Different clocks.
  • Does our insurer require notice?
    Often within a set period.
  • Would encryption exempt us?
    A named exception.
  • Have we ever rehearsed this?
    Timed, not discussed.
Related reading

The pages around this one.

Incident response plan

The response the notification sits on top of.

Learn more

Tabletop exercise

Where the plan meets a clock.

Learn more

GDPR for UAE businesses

The wider obligation behind the 72 hours.

Learn more
Next step

Ask who is allowed to declare a personal data breach in your organisation.

Then ask what happens if that person is on a plane. The answer to the second question is usually where your 72 hours would go.

Book a notification readiness reviewCall +971 56 613 2743

Related Services

Explore more solutions that work great with this service

Incident Response Plan

Written, exercised, and findable when the network is not

Learn more

Tabletop Exercise

Test the decisions, not the documentation

Learn more

GDPR for UAE Businesses

When EU law actually reaches a UAE business, and when it does not

Learn more

UAE PDPL Compliance

Federal Decree-Law 45 of 2021 readiness and operations

Learn more

NIS2 compliance

What EU essential and important entities need from suppliers.

Learn more

DORA compliance

What EU financial customers now require from UAE ICT suppliers.

Learn more

Records of processing activities

The Article 30 record, complete and producible on request.

Learn more

Compliance as a Service

Keeping the position true between assessments

Learn more
GR IT SERVICES

Leading IT services provider in Dubai,
delivering enterprise-grade solutions
for businesses across the UAE.

Microsoft CSP PartnerCISGuard

Get the Helpdesk app

Raise and track IT tickets from your phone.

Download on the App StoreGet it on Google Play
Learn more about the app

Microsoft 365

  • Microsoft 365 Administration
  • M365 Reporting & Auditing
  • Microsoft 365 Licensing
  • Microsoft Copilot
  • Microsoft 365 Apps
  • Windows 365 Cloud PC
  • Microsoft SharePoint
  • Outlook & Exchange

Security

  • Microsoft Defender
  • Microsoft Purview
  • Microsoft Intune
  • Microsoft Entra
  • Compliance Manager
  • Cybersecurity Audits
  • Copilot for Security
  • Microsoft Sentinel
  • Microsoft Priva

Infrastructure

  • Google Workspace
  • Cloud Migration Services
  • Data Analytics & BI
  • Active Directory
  • Server Management
  • Apple Business
  • Apple Jamf Pro
  • IP Telephone
  • Data Backup
  • Website Development

IT Services

  • Managed IT Services
  • IT Support Dubai
  • IT AMC Dubai
  • New Office IT Setup
  • IT Relocation
  • Remote IT Support
  • On-Call IT Support
  • Startup IT Business Kit
  • Disaster Recovery & BC

Company

  • About Us
  • Careers
  • Contact
  • Blog

Contact

  • Iris Bay Tower, Office 903,
    Business Bay, Dubai, UAE
  • +971 56 613 2743
  • hello@gritservices.ae
  • gritservices.ae

© 2026 GR IT Services. All rights reserved.

Privacy PolicyTerms of UseCookie Policy