Incident management & data breach support

Our expert team helps you respond to and manage data breaches in full compliance with the Data Protection regulations. We ensure timely reporting, minimize risks, and protect your reputation while meeting the notification requirements that apply to you.

Key Benefits:

✔ Meet breach notification deadlines under each applicable law

✔ Regulatory liaison with Middle East authorities

✔ Incident containment and risk mitigation

✔ Post-breach compliance and improvement plans

Breach notification rules differ by country

When personal data is lost, stolen or exposed, the clock starts quickly, and the deadlines are not the same everywhere:

• UAE PDPL: requires the controller to notify the UAE Data Office immediately on becoming aware of a breach that would prejudice the privacy, confidentiality or security of personal data, and to inform affected individuals where required. The law does not set a fixed number of hours, which is why speed matters.
• GDPR and UK GDPR: notification to the supervisory authority within 72 hours of becoming aware, where the breach is likely to result in a risk to individuals, and to individuals without undue delay where the risk is high.
• DIFC DPL and ADGM DPR: under the DIFC DPL (Article 41), the controller must notify the Commissioner of Data Protection as soon as practicable in the circumstances where a breach compromises a data subject’s confidentiality, security or privacy. Under the ADGM DPR, the controller must notify the Office of Data Protection without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals. Both also require affected individuals to be told where the risk is high.
• Saudi PDPL: notification to SDAIA within 72 hours of becoming aware of a breach that may cause harm, and to affected individuals without undue delay in certain cases.

Operating across several jurisdictions can mean several notifications at once. This page is general information, not legal advice.

What our incident management and breach support includes

• Incident response plan: a clear plan, roles and escalation path built for your business
• Breach assessment: working out what happened, what data is involved and whether notification is required
• Regulator notification: deciding which authorities to notify, preparing and reviewing the notifications
• Individual communications: drafting clear, accurate notices to affected people
• Coordination with technical teams: working alongside your IT, security and legal advisers
• Breach register: recording every incident and the decision reached, as the law expects
• Post-incident review: root-cause findings and fixes to stop a repeat
• Tabletop exercises and training: rehearsing a breach so your team knows what to do under pressure

What happens when a breach occurs

1. Contain: stop the exposure and preserve evidence.
2. Assess: establish what data, whose data and what the risks are.
3. Decide: determine who must be notified and by when under each applicable law.
4. Notify: submit regulator notifications and inform individuals where required.
5. Recover and learn: fix the cause, document the incident and update your controls.

Be ready before it happens

Most of the damage in a breach comes from slow, unclear decisions. Preparing a plan, naming decision-makers and rehearsing the process makes the difference. We can combine incident readiness with a data protection audit, or provide ongoing support through our outsourced DPO service.

Frequently asked questions

What counts as a personal data breach?

Any incident that leads to accidental or unlawful loss, alteration, unauthorised disclosure of or access to personal data. It includes cyberattacks, but also lost devices, emails sent to the wrong recipient and unauthorised internal access.

Do we always have to notify the regulator?

Not in every case. Thresholds differ by law, and low-risk breaches may not need notification, but they should still be recorded. We help you make and document that decision quickly.

Who should we call first?

Contain the incident with your IT or security team and contact us as early as you can, so the notification clock and the legal analysis are handled in parallel.

Can you help if we operate in several countries?

Yes. We map the notification duties in each relevant jurisdiction, including the UAE, DIFC, ADGM and KSA regimes and EU and UK GDPR.