Executive Regulation of the Personal Data Protection Law — Article 30

A Controller must notify the Competent Department within 72 hours of learning of a breach that may threaten Data Subjects' rights. The notice must describe the breached data and consequences; give Controller or contact-point details; describe likely effects; state planned remedial, technical and organisational measures, including mitigation where needed; and state measures already taken before notification.

Interpretation and application must be checked against the official Arabic text and the current version.