Executive Regulation of the Personal Data Protection Law — Article 33

The Controller must document breaches, their causes and consequences, and corrective, technical or organisational measures, and retain that information for the period set by the Competent Department in the article 28 register.

Interpretation and application must be checked against the official Arabic text and the current version.