Data Breach Notification Timelines: India, UAE, DIFC, ADGM, Saudi and GCC Compared

One incident, several clocks

A single security incident can start more than one legal deadline at the same time. In India there are two separate regimes. The CERT-In Directions require reportable cyber incidents to be reported to CERT-In within 6 hours of noticing them. Once the DPDP core duties apply from 13 May 2027, Rule 7 also requires notice to the Data Protection Board without delay, a detailed report within 72 hours of becoming aware, and notice to each affected Data Principal without delay. The CERT-In report does not replace the DPDP notice.

If the same product also serves Gulf users, the regulators there may need notice too, each with its own wording. For example, an Indian SaaS company that hosts a Saudi retailer's customer data might face a CERT-In report, a DPDP notice and, through its client, a 72-hour report to SDAIA. Your incident plan should identify every applicable clock in the first hour, not after the investigation ends.

The comparison

The list below summarises who must be told and how fast. Read it alongside your client contracts, because many B2B agreements set shorter vendor deadlines than the law. The code sample after it shows one way to store this as configuration for an incident tool. It is illustrative only, so confirm current deadlines against the official texts and your legal advisers before relying on it.

• India, CERT-In: report cyber incidents within 6 hours of noticing them.
• India, DPDP: tell the Board without delay and send a detailed report within 72 hours; tell affected Data Principals without delay.
• UAE onshore: controller notifies the Data Office immediately on becoming aware and notifies affected data subjects (Article 9).
• DIFC: notify the Commissioner as soon as practicable in the circumstances (Article 41(1)); tell data subjects in certain cases.
• ADGM: notify the Commissioner within 72 hours unless the breach is unlikely to risk rights, with reasons for any delay.
• Saudi Arabia: notify SDAIA through the National Data Governance Platform within 72 hours where harm may result.
• Qatar, Bahrain and Oman: notify the regulator within 72 hours; Oman also tells individuals within 72 hours where severe damage is likely.

{
  "_note": "Illustrative only. Check official texts before use.",
  "breach_clocks": [
    {"market": "IN", "authority": "CERT-In", "deadline_hours": 6},
    {"market": "IN", "authority": "Data Protection Board", "initial": "without delay", "detailed_report_hours": 72},
    {"market": "AE", "authority": "UAE Data Office", "initial": "immediately"},
    {"market": "AE-DIFC", "authority": "Commissioner of Data Protection", "initial": "as soon as practicable"},
    {"market": "AE-ADGM", "authority": "Commissioner of Data Protection", "deadline_hours": 72},
    {"market": "SA", "authority": "SDAIA", "deadline_hours": 72},
    {"market": "QA", "authority": "NCSA", "deadline_hours": 72},
    {"market": "BH", "authority": "PDPA", "deadline_hours": 72},
    {"market": "OM", "authority": "MTCIT", "deadline_hours": 72}
  ]
}

What to tell users and how processors fit in

For India, the notice to each affected Data Principal should explain in plain language what happened, the likely impact, the steps you have taken to reduce harm and a contact person who can answer questions. DIFC Law Article 41(4) lists required content for notices to the Commissioner. Write templates for these messages in advance, in English and the local languages you support, so that nobody drafts them from scratch at 2 a.m.

Processors carry their own duty to alert controllers. Under the UAE PDPL, processors alert the controller as soon as they become aware of a breach, and under DIFC Article 41(2) processors notify controllers without undue delay. If you are the vendor, your contract should say how you will alert the client and what details you will share. If you are the controller, require vendors to notify you fast enough that you can still meet a 6-hour or 72-hour regulator deadline.

Running a breach drill

Enforcement in the region is active. In February 2026 Qatar's National Cyber Security Agency publicised Binding Decision No. 3 of 2025 against a sports company after a data breach. A drill twice a year keeps your plan honest. Pick a realistic scenario, such as an exposed storage bucket containing customer records from India and Saudi Arabia, and walk through detection, triage, legal assessment, notices and user communication against the clock. Record what slowed you down and fix it before the next drill.

Common gaps show up quickly in drills. Teams often find that nobody knows who holds the CERT-In point of contact role on a weekend, that logs needed for the investigation were kept for too short a period, or that the support team has no approved wording for anxious customers. Others find that client contracts promise notice within 24 hours, which is stricter than the law. Fix each gap with a named owner and a date, and repeat the drill with a fresh scenario next time. General information, not legal advice.

Check your understanding

Turn what you learn into monthly income

Resell AI agents and apps under your own brand. Up to 30% off credits, up to 30% recurring share, and apps built by XDQ Labs for your clients. Free to join.