TRW & Co · Data, Privacy & Cyber
Data Breach Response in the UAE
Data breach response in the UAE means working across three data protection regimes at once: the federal PDPL, the DIFC law and the ADGM regulations, each with its own regulator and clock. Add sector duties for banks and health providers and foreign rules for overseas customers, and the first 72 hours decide most of the legal outcome.
Key pointSince 15 July 2025, individuals affected by a breach in the DIFC can claim compensation, including for distress, directly in the DIFC Courts, and processors face direct liability, so a DIFC incident now carries litigation risk as well as regulatory risk.
At a glance
Three parallel regimes
The federal PDPL applies onshore and in most free zones, while the DIFC and ADGM run their own data protection laws, regulators and breach rules.
ADGM 72-hour window
ADGM controllers must notify the Commissioner without undue delay and, where feasible, within 72 hours of becoming aware of a reportable breach.
DIFC claims now possible
Amendments in force from 15 July 2025 let individuals seek compensation in the DIFC Courts, including for distress, from controllers and processors.
PDPL detail still pending
Article 9 of the PDPL requires notification on becoming aware of a breach, but timing detail awaits Executive Regulations not issued as at mid-2026.
Banks face extra duties
Federal Decree-Law No. 6 of 2025 on the Central Bank, in force since September 2025, requires prompt reporting of confirmed security breaches.
Swipe or scroll →
What data breach response in the UAE covers
Data breach response in the UAE is the legal and practical work that follows when personal data is lost, stolen, encrypted, disclosed or altered without authority. It covers containment and investigation, deciding which regulators and individuals must be told and when, managing law enforcement and insurers, and limiting the claims and regulatory action that can follow.
The trigger is wider than a hacker. Ransomware, business email compromise, a misdirected spreadsheet, an employee taking a customer list to a competitor, a misconfigured cloud bucket and an incident at a payroll or IT supplier can all be personal data breaches. The legal question is the same: whose data, which law applies, and what has to happen next.
The UAE has several data protection regimes running side by side: the federal law onshore and in most free zones, and separate common-law-style regimes in the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM). One incident can engage all three, plus sector regulators, foreign laws and contracts with customers.
The legal framework for data breach response in the UAE
Federal Personal Data Protection Law
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), in force since 2 January 2022, applies to processing onshore and in free zones other than the DIFC and ADGM. Article 9 requires a controller, on becoming aware of a breach that would prejudice the privacy, confidentiality or security of personal data, to notify the regulator with a description of the breach, its causes, the approximate number of records and individuals, the data protection officer’s details, the likely effects and the corrective measures.
The controller must also inform affected individuals where the breach would prejudice their privacy and confidentiality, and a processor must notify its controller as soon as it becomes aware.
The deadlines and procedural detail were left to Executive Regulations, which had not been issued as at mid-2026. The regulator named in the PDPL, the UAE Data Office, is being folded into the Federal Authority for Artificial Intelligence and Data announced in June 2026. Until detailed rules appear, controllers should act on the statutory text: notify promptly and document why. The government’s data protection laws page summarises the PDPL, and our page on federal personal-data protection explains the wider regime.
DIFC and ADGM
Under the DIFC Data Protection Law 2020, a controller must notify the Commissioner of Data Protection as soon as practicable in the circumstances where a breach compromises a data subject’s confidentiality, security or privacy, and inform affected individuals where the breach is likely to create a high risk to them. Since amendments in force from 15 July 2025, individuals can claim compensation, including for distress, directly in the DIFC Courts, and processors face direct liability for their own failings. Information is available from the DIFC; see also our page on DIFC data protection.
The ADGM Data Protection Regulations 2021 follow the GDPR model: notify the Commissioner without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals, and tell affected individuals without undue delay where the risk is high. The ADGM Office of Data Protection publishes guidance and the reporting route.
Sector rules and cybersecurity bodies
Financial institutions face additional duties. Federal Decree-Law No. 6 of 2025 on the Central Bank, which took effect in September 2025, requires licensed institutions to maintain fraud and security controls and to report confirmed security breaches promptly, on top of the CBUAE’s existing incident-reporting expectations. DFSA and FSRA-regulated firms have notification duties to their own regulators. Health data is governed by Federal Law No. 2 of 2019 on the use of ICT in health fields and by emirate health authorities.
Dubai government entities report to the Dubai Electronic Security Center, and the national cyber agenda is led by the UAE Cyber Security Council. Criminal conduct such as hacking and extortion falls under the Cybercrime Law, Federal Decree-Law No. 34 of 2021.
| Regime | Regulator | Timing to regulator | Individuals |
|---|---|---|---|
| Federal PDPL | UAE Data Office (moving into the Federal Authority for AI and Data) | On becoming aware; detailed period left to Executive Regulations | Where the breach prejudices their privacy and confidentiality |
| DIFC Data Protection Law 2020 | DIFC Commissioner of Data Protection | As soon as practicable in the circumstances | Where likely to create a high risk; private compensation claims available |
| ADGM Data Protection Regulations 2021 | ADGM Commissioner of Data Protection | Without undue delay, and where feasible within 72 hours | Without undue delay where the risk is high |
| CBUAE-licensed institutions | Central Bank of the UAE | Promptly, under CBUAE law and rules | Under consumer protection rules and contracts |
| Dubai government entities | Dubai Electronic Security Center | Under Dubai information security rules | Per the entity’s obligations |
The first decisions: is it a breach, whose rules, and who leads?
The first hours of data breach response in the UAE turn on four questions. Is personal data involved, or only commercial information? Which entity is the controller, and where is it licensed: onshore, in a free zone, in the DIFC or in the ADGM? Are the affected individuals located abroad, bringing in foreign laws? And are any regulated activities involved, such as banking, insurance, payments or health care?
Next, decide who leads. A small incident team with legal, IT security, communications, the data protection officer and an executive decision-maker is more effective than a large committee. Appoint external forensic investigators through counsel where possible, so that the scope of work and reports are structured with legal privilege and confidentiality in mind. Notify insurers early: most cyber policies require prompt notice and consent before engaging vendors.
Finally, set the decision rights. Agree who can approve regulator filings, individual notices, public statements and any engagement with attackers, and record those approvals in the incident log. Clear authority avoids delay at the moments when the clock matters most, and it shows regulators that senior management was in control of the response.
The regulator will judge the response less by whether the breach happened than by how quickly you understood it, what you told people, and whether your records show the reasoning at the time.
Data breach response in the UAE: the first 72 hours and beyond
- Contain and preserve. Isolate affected systems, reset credentials and block exfiltration routes, while preserving logs, images and emails needed for the investigation.
- Convene the team and open a log. Record when the organisation became aware, every decision taken and the reasons; this log is the core evidence of compliance.
- Scope the data. Identify categories of data, numbers of individuals, their locations and whether sensitive data such as health, biometric or financial data is involved.
- Map the obligations. Determine which regimes apply, which regulators must be told and by when, and what customer contracts and insurance policies require.
- Notify regulators. File initial notifications within the applicable windows, with follow-up reports as facts develop, keeping statements accurate and consistent across regulators.
- Tell individuals and counterparties. Send clear, plain-language notices with practical steps to reduce harm, and meet contractual notice duties to clients and partners.
- Engage law enforcement where appropriate. Report criminal activity, such as extortion or fraud, to the police or relevant authority, and coordinate on evidence.
- Remediate and review. Fix root causes, update policies and contracts, brief the board and record lessons learned for regulators and auditors.
Documents and evidence to assemble
A well-run response produces a coherent document trail. The essentials are: the incident log with timestamps; the breach register entry, which the DIFC and ADGM regimes require even for breaches that are not notified; forensic reports, ideally commissioned by counsel; copies of regulator notifications and correspondence; templates and records of individual notifications; customer and supplier notices; insurer notifications; board minutes; and the remediation plan.
Before an incident, the most valuable documents are a tested incident response plan, a contact list for regulators and vendors, pre-approved notification templates for each regime, and data maps showing what personal data is held where. Processor contracts should already specify notice periods and cooperation duties; our page on data-processing agreements sets out what to include.
Decide in advance who in the business can declare a breach and authorise notifications out of hours. In multi-regime incidents, the ADGM’s 72-hour expectation and the DIFC’s “as soon as practicable” standard leave little time for internal debate.
Communications, employees and reputation
Legal notifications are only part of data breach response in the UAE. Customers, employees, business partners and sometimes the media will want answers quickly, and what they hear shapes complaints, claims and regulatory interest. Communications should be accurate, consistent with regulatory filings and careful not to speculate about attackers or promise outcomes the organisation cannot guarantee.
Prepare a short holding statement early, then layered messages: a notice for affected individuals, a briefing for customer-facing staff, a frequently asked questions sheet and, where needed, a media statement. Each should say what happened in plain language, what data was involved, what the organisation is doing and what people can do to protect themselves, such as resetting passwords or watching for phishing that uses the stolen data.
Employees are often both victims and witnesses. Where staff data is affected, tell employees directly before they read about it elsewhere. Where an insider is suspected, coordinate the employment and evidential steps carefully, because a rushed dismissal can compromise the investigation; our page on workplace investigations covers the process. Defamation and cybercrime rules also make it important to avoid naming individuals publicly without a firm basis.
Finally, keep a record of every communication and when it was sent. In a later regulatory review, a clear timeline showing prompt, honest and consistent messages is strong evidence that data breach response in the UAE was handled responsibly.
Risks and common mistakes
Waiting for certainty before notifying
Teams often delay notification until the forensic investigation is complete. Regulators generally expect an initial notification once the organisation reasonably believes a reportable breach has occurred, with updates as facts emerge. In the ADGM the expectation is 72 hours where feasible; in the DIFC it is as soon as practicable; and the PDPL requires action on becoming aware. Late notification is often treated as a separate failure. File an initial report with what is known, flag what is still being investigated and supplement it.
Inconsistent statements to regulators, customers and the press
In a multi-regime incident, the same facts are described to the PDPL regulator, the DIFC or ADGM Commissioner, a financial regulator, customers, insurers and sometimes the media. Small differences in the number of affected people or the date of discovery can undermine credibility and later be used in claims. Use a single fact sheet controlled by the legal lead, update it centrally and route every external statement through it.
Mishandling a ransom demand
Ransom payments raise sanctions, anti-money laundering, insurance and regulatory questions, and paying does not remove notification duties or guarantee that data is deleted. Threat actors may be linked to sanctioned persons, which creates exposure for the payer and any intermediary. Take legal advice before engaging with attackers, involve insurers, report the extortion to law enforcement and document the decision. Our sanctions team can assess counterparty risk.
Forgetting the supplier chain
Many breaches start at a processor: a payroll provider, a cloud host or a marketing agency. The controller remains responsible for notifying regulators and individuals, even though it depends on the supplier for facts. Contracts without clear notice periods, cooperation and audit rights slow the response. Since July 2025, DIFC processors also face direct liability. Review supplier terms now, and during an incident demand written answers to specific questions.
Losing privilege over the investigation
Forensic reports written for operational purposes and circulated widely may be disclosable in later claims or regulatory proceedings. Privilege rules differ between the DIFC and ADGM courts, which follow common-law principles, and onshore courts, where the position is less developed. Engage forensic firms through counsel, define the scope as legal advice support, restrict circulation and separate root-cause reports for remediation from the legal analysis. Discuss the approach with insurers, who may want reports too.
Treating the incident as over once systems are restored
Regulatory enquiries, customer complaints and compensation claims often arrive months later. The DIFC private right of action means affected individuals can sue, and contractual claims from business customers are common. Keep the incident file intact, track complaints, and prepare a remediation report that shows what changed. Our commercial litigation team advises on claims that follow incidents.
Cross-border breaches: UK, Singapore, Saudi Arabia, India, China and Bangladesh
Data breach response in the UAE often has to run in parallel with foreign regimes, because customers, employees or group systems sit abroad. Each regime has its own trigger and clock, and the earliest deadline drives the timetable.
United Kingdom. The UK GDPR requires notification to the Information Commissioner’s Office within 72 hours of becoming aware of a reportable breach. UAE groups with UK customers or a UK establishment should prepare for that clock from the outset.
Singapore. Under the Personal Data Protection Act, once an organisation assesses that a breach is notifiable it must notify the Personal Data Protection Commission within three calendar days, and affected individuals in many cases.
Saudi Arabia and the GCC. Saudi Arabia’s Personal Data Protection Law requires prompt notification to its data authority, with short fixed windows under its implementing regulations. Groups operating across the Gulf should map each country’s rule.
India, China and Bangladesh. India’s Digital Personal Data Protection regime, being brought into force in phases, introduces breach reporting to its Data Protection Board. China’s Personal Information Protection Law requires immediate remedial action and notification. Bangladesh’s data protection and cybersecurity framework is evolving, and Dhaka-based service centres processing UAE data should follow the stricter of the two regimes. For transfer-related issues, see our page on cross-border data transfers.
How TRW & Co helps with data breach response in the UAE
We advise controllers and processors before, during and after incidents, working with forensic, communications and insurance partners. Our role is legal strategy, regulatory engagement and coordination across jurisdictions. Where proceedings arise before the UAE onshore courts or the DIFC/ADGM Courts, we work alongside locally licensed advocates and registered practitioners.
Incident readiness
We prepare incident response plans, notification templates for each UAE regime and tabletop exercises, so the first hours are not spent finding the rules.
Live incident counsel
We help scope the data, map obligations, engage forensic firms through counsel and draft regulator, customer and individual notifications.
Regulator engagement
We manage follow-up questions from data protection commissioners and financial regulators, keeping statements consistent across agencies.
Claims and recovery
We advise on supplier recovery, insurance coverage, customer claims and DIFC compensation claims after an incident.
Related pages cover cybersecurity incidents, ADGM data protection and AI governance, where AI-related data leakage is increasingly common. Our full range of services is on our practices page. Telecoms and ICT matters may also involve the TDRA.
Checklist for decision-makers
- Do we know which data protection regimes apply to each group entity: PDPL, DIFC, ADGM or foreign laws?
- Is there a tested incident response plan with named decision-makers available out of hours?
- Do we have notification templates and regulator contact routes ready for each regime?
- Can we produce a data map showing where personal data, including sensitive data, is held?
- Do processor contracts set short notice periods and cooperation duties?
- Is forensic support pre-arranged through counsel, and does our cyber insurance cover it?
- Have we agreed a policy on ransom demands, sanctions screening and law enforcement contact?
- Does the board receive regular reports on incidents and readiness?
If you are dealing with an incident now, contact TRW & Co at info@trw.co or +971 58 942 1012.
Frequently asked questions
01How quickly must we notify a data breach in the UAE?
It depends on the regime. Under the federal PDPL a controller must notify the regulator on becoming aware of a breach, with the detailed period left to Executive Regulations not issued as at mid-2026. The DIFC requires notification as soon as practicable in the circumstances. The ADGM expects notification without undue delay and, where feasible, within 72 hours. Sector regulators and foreign laws may impose their own deadlines, and the earliest one should drive your timetable.
02Do we have to tell affected individuals?
Often, yes. The PDPL requires controllers to inform data subjects where a breach would prejudice their privacy and confidentiality. The DIFC and ADGM regimes require notification without undue delay where the breach is likely to result in a high risk to individuals. Notices should be in clear language, explain what happened and what data was affected, and tell people what they can do to protect themselves. Contracts may require notices to business customers too.
03Which law applies if we are in a free zone?
Most free zones fall under the federal PDPL. The DIFC and ADGM are different: each has its own data protection law, Commissioner and breach rules, and the PDPL does not apply to processing governed by them. A group with entities onshore, in a non-financial free zone and in the DIFC or ADGM may need to apply several regimes to one incident, depending on which entity is the controller of each data set.
04Can individuals sue us after a breach?
In the DIFC, amendments in force from 15 July 2025 give data subjects a direct right to seek compensation in the DIFC Courts for contraventions, covering financial loss and non-financial loss such as distress, against controllers, processors or both. Elsewhere, claims may be brought under general civil liability principles or contracts. Business customers frequently claim under service agreements. Preserve the incident file and prepare for claims even after systems are restored.
05Should we pay a ransomware demand?
This is a business decision with legal limits. Payment raises sanctions, anti-money laundering, insurance and regulatory issues, especially if the attackers may be linked to sanctioned persons, and it does not remove notification duties or guarantee deletion of stolen data. Take legal advice before any contact, involve your insurer, report the extortion to law enforcement and document the reasoning. Many organisations restore from backups and focus on notification and containment instead.
06What should a processor do when it suffers a breach?
A processor must notify its controller promptly; the PDPL requires notice as soon as the processor becomes aware. The processor then supports the controller's investigation and notifications under the contract. In the DIFC, processors now face direct liability for their own failures, so they should keep their own incident records and take advice on their exposure as well as cooperating fully with the controller.
07Does a bank or payment firm have extra duties?
Yes. Federal Decree-Law No. 6 of 2025 on the Central Bank, in force since September 2025, requires licensed institutions to maintain fraud and security controls and to report confirmed security breaches promptly, alongside CBUAE incident-reporting rules. Firms regulated by the DFSA or FSRA must notify those regulators under their rulebooks. These duties run alongside data protection notifications, so the same facts must be reported consistently to each authority.
Sources and official materials
- UAE Government portal: Data protection laws — Overview of Federal Decree-Law No. 45 of 2021
- ADGM Office of Data Protection — ADGM Data Protection Regulations 2021, breach reporting and guidance
- Dubai International Financial Centre — DIFC Data Protection Law 2020 and Commissioner of Data Protection
- Dubai Electronic Security Center — Information security rules for Dubai government entities
- Telecommunications and Digital Government Regulatory Authority — Federal ICT regulator
- Central Bank of the UAE — Rulebook and incident reporting for licensed financial institutions
General information only, current as at 27 October 2026. It is not legal advice and does not create a lawyer–client relationship. UAE law differs between the onshore jurisdiction, the DIFC, ADGM and the free zones, and changes frequently; check current official sources and take advice on the facts of your matter.
