How quickly must a data breach be reported under Qatar's PDPPL?

Within 72 hours. Under Qatar's Personal Data Privacy Protection Law, a business must notify the regulator of a personal data breach within 72 hours, and must also notify the people affected where the breach is likely to cause them harm. The regulator is part of the National Cyber Security Agency.

The regulator is the National Cyber Governance and Assurance Affairs at the National Cyber Security Agency. A website that keeps a record of who consented to what, and when, has part of the evidence a breach review asks for.