GCC breach notification: the 72-hour norm and its gaps

Published 2026-10-18 · 6 min read · Samtaro Security & Legal

This summary draws on a comparison ClairSec published on 10 October 2026. ClairSec says plainly that it is not a law firm, and that for several markets it relied on law-firm commentary rather than the legal text (ClairSec). We repeat its confidence notes.

Market	As reported	How well sourced (per ClairSec)
Saudi Arabia	Notify SDAIA within 72 hours of becoming aware of a breach that may harm the personal data or data subjects, or conflict with their rights or interests (PDPL Implementing Regulations, Art. 24(1)). Information not available within 72 hours goes in as soon as possible with reasons for the delay (Art. 24(2)), and affected individuals are told without undue delay (Art. 24(5)). Notices go through SDAIA's National Data Governance Platform, which requires registration (SDAIA breach guide). ClairSec reports draft amendments under consultation that would drop the harm test; we haven't seen those in an official text.	Checked against SDAIA's Implementing Regulations and breach guide (23 Oct 2026)
Qatar	The statute requires informing the individual and the competent department of a breach likely to cause serious damage, with no hour count. NCSA's guideline expects notification of the regulator and individuals within 72 hours of becoming aware, where the breach can cause serious damage (NCSA breach notification guideline). NCSA's privacy library also lists a Personal Data Breach form for regulated entities (English, v2.1), so check you have the current form before you need it (NCSA privacy library).	Law text and NCSA guideline
Oman	Notify the regulator within 72 hours of a breach that may put data subjects' rights at risk. Fully enforceable from 5 February 2026.	Law-firm commentary; not checked against the decree
Bahrain	Notify the Personal Data Protection Authority within 72 hours, with a documented reason if late.	Law-firm commentary
UAE (federal)	Breach reporting required; the period is left to executive regulations. No deadline stated.	Commentary only
Kuwait	No general data-protection statute found. A telecom-regulator rule for licensed providers is described as 24-hour reporting.	Commentary; sources disagree

For QFC firms, the QFC Data Protection Regulations set a 72-hour deadline to notify the QFC DPO (Art. 31(1)). The DPO has penalised late notification (QFC summary). In the EU, GDPR Art. 33 requires notice without undue delay and, where feasible, within 72 hours.

Building a multi-country playbook

1. List each country you process data in, its regulator, and the trigger and timing that apply.
2. Plan to the strictest clock you face.
3. Make your processors' notification duty to you shorter than your own deadline. The QFC case shows a processor's delay doesn't stop the controller's clock.
4. Pre-draft notices to regulators and individuals.
5. Rehearse once a year: who decides, who notifies, who briefs the board.

This article is for general educational purposes and is not legal advice. Seek qualified counsel for your specific situation.