Executive Regulation of the Personal Data Protection Law — Article 32

Where a breach may cause serious harm or high risk, the Controller must notify the Data Subject within 72 hours of becoming aware. The notice must state the type and nature of breach, details of affected Personal Data, and recommendations to limit or mitigate effects where needed.

Interpretation and application must be checked against the official Arabic text and the current version.