Data Breach Notification · 72 Hours · UK GDPR · EU GDPR · UAE
Personal Data Breach? The 72-Hour Clock Has Started
A lost laptop, a hacked mailbox, a misdirected email or a ransomware attack can all be personal data breaches. We help UAE companies assess the risk, decide whether data breach notification is required, and report to regulators and affected people on time.
The Legal Requirement
Data Breach Notification Rules Under GDPR
Under Article 33 of the UK GDPR and the EU GDPR, a controller must report a personal data breach to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it. The only exception is a breach that is unlikely to result in a risk to individuals. For UK breaches, the regulator is the ICO (see ICO: Report a breach). For EU breaches, it is the relevant national authority.
In addition, if the breach is likely to result in a high risk to individuals, Article 34 requires you to tell the affected people directly, without undue delay. Every breach, including those you decide not to report, must be recorded internally with the facts, effects and remedial action taken.
For a UAE company, the UK and EU rules may apply alongside the UAE PDPL and the DIFC and ADGM regimes, which have their own breach reporting duties. As a result, one incident can trigger several reports with different requirements.
- 01
72 Hours
The target deadline for notifying the regulator, counted from when you become aware.
- 02
High Risk
If individuals face a high risk, they must be told directly.
- 03
Record Everything
Keep an internal record of every breach, even when no report is required.
- 04
Processors
Service providers must tell you without undue delay after they discover a breach.
Our Service
How We Help With Data Breach Notification
Fast, structured support from the first hour of an incident to the final report.
Rapid Risk Assessment
We assess what data was affected, how many people, and how serious the risk is.
Notification Decision
A documented decision on whether to notify the ICO, EU authorities, UAE regulators and individuals.
Regulator Reports
We prepare and submit the breach report with the information the regulator expects.
Messages to Individuals
Clear notifications that explain what happened and what people should do.
Breach Register
An internal record of every breach that meets Article 33(5).
Breach Response Plan
A plan prepared in advance, so your team knows exactly what to do when an incident occurs.
Typical Incidents
What Counts as a Personal Data Breach
Cyber Attacks
Ransomware, phishing or a compromised account that exposes customer data.
Human Error
An email sent to the wrong person, or a spreadsheet shared publicly by mistake.
Lost Devices
An unencrypted laptop or phone containing personal data.
Supplier Incidents
A breach at your cloud, payroll or marketing provider that affects your data.
Breach readiness starts with knowing your data. See also: records of processing activities · privacy policy UAE · data subject access requests · UK GDPR representative.
How It Works
Four Steps When a Breach Happens
Contain
Stop the breach and preserve evidence.
Assess
Identify the data, the people affected and the level of risk.
Notify
Report to regulators and individuals where required, on time.
Learn
Record the breach and fix the cause so it does not happen again.
Common Questions
Data Breach Notification — FAQ
Get Started
Facing a Data Breach Right Now?
Act fast and get it right. Contact us for immediate support with risk assessment and data breach notification.
WhatsApp Us NowOr contact us directly: +44 7368 955207 · a.moini@padinternationalgroup.com