How quickly must a data breach be reported under the UAE PDPL?

Without undue delay. Under Federal Decree-Law No. 45 of 2021, a controller notifies the UAE Data Office and the affected data subjects of a personal data breach without undue delay. Much of the detail is left to executive regulations, which had not been published on the UAE's official legislation portal as of September 2026.

So a website needs a plan to notify the Data Office before anything happens, alongside appropriate technical and organisational measures that protect personal data against unauthorised access, and a way to answer data requests.

Entities established in the DIFC or ADGM follow their own free zones' data protection laws, with their own regulators. Penalty amounts under the federal law are left to a Cabinet decision under Article 26, unpublished as of September 2026.