What must a UAE business do if it suffers a personal data breach?

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), a controller that experiences a personal data breach — a security incident leading to unauthorised access, disclosure, loss or alteration of personal data — has specific obligations. The core duties are to assess the incident, and where it poses a risk to the privacy, confidentiality or security of the affected individuals' data, to notify the UAE Data Office, and in defined circumstances to notify the affected data subjects. A processor that becomes aware of a breach must inform the controller. The notification should describe the nature of the breach, the data and individuals affected, the likely consequences, and the measures taken or proposed to address it and limit harm. The precise notification timing, thresholds and content are set out in the law and its Executive Regulations, so confirm the current requirements with the UAE Data Office rather than relying on assumptions. Businesses should also keep an internal record of breaches. Before an incident occurs, having an incident-response plan and clear contracts with processors is essential. For help building one, you can compare verified UAE legal professionals on LEXAI.