A company that operates in India and the Gulf can face several breach clocks at once. CERT-In expects a report within 6 hours, India's DPDP Rules add a 72-hour detailed report from 13 May 2027, and Saudi Arabia, ADGM, Qatar, Bahrain and Oman all use 72 hours. The UAE and DIFC use wording instead of hours. This guide puts every deadline in one table.
Why the deadlines differ
Breach rules across India and the GCC fall into three groups. Some set a fixed hour count, mostly 72 hours. Some use words such as immediately or as soon as practicable. India adds a separate cyber incident regime under CERT-In with a 6-hour clock that applies on top of the data protection rules. The clock also starts at different points. Most regimes count from becoming aware of the breach, Bahrain counts from discovery, and CERT-In counts from noticing the incident.
The comparison table
The table lists the regulator, the deadline and the duty to tell individuals for each regime covered in this guide. Use it to build the timeline section of your incident response plan, and keep a copy in the plan itself so the incident lead does not need to look it up under pressure.
| Jurisdiction | Notify | Deadline | Tell individuals |
|---|---|---|---|
| India (CERT-In) | CERT-In | Within 6 hours of noticing the incident | Not specified in this guide's sources |
| India (DPDP, from 13 May 2027) | Data Protection Board | Without delay, detailed report within 72 hours (Rule 7) | Each affected Data Principal, without delay |
| UAE onshore (PDPL) | UAE Data Office | Immediately on becoming aware (Article 9) | Yes |
| DIFC | Commissioner of Data Protection | As soon as practicable (Article 41(1)) | In certain cases |
| ADGM | Commissioner of Data Protection | Within 72 hours, unless unlikely to risk rights | Without undue delay where high risk is likely |
| Saudi Arabia | SDAIA via National Data Governance Platform | Within 72 hours where harm may result (Article 20) | Without undue delay |
| Qatar | NCSA | Within 72 hours where serious damage is possible (guidelines) | Within 72 hours |
| Bahrain | PDPA | Within 72 hours of discovery (Resolution No. 43 of 2022) | Generally yes |
| Oman | MTCIT | Within 72 hours where rights are likely endangered | Within 72 hours where severe damage is likely |
India: two clocks at once
CERT-In's Directions of 28 April 2022, in force since 28 June 2022, require reportable cyber incidents to be reported within 6 hours of noticing them. The Directions also require a named point of contact for CERT-In, 180 days of logs kept in India and clocks synced to NIC or NPL time servers.
From 13 May 2027, Rule 7 of the DPDP Rules 2025 adds a second duty for personal data breaches: notify the Data Protection Board without delay and send a detailed report within 72 hours, unless the Board allows longer. Each affected Data Principal must be told the nature, impact, mitigation and a contact.
UAE: three regimes, three standards
Onshore, Article 9 of the UAE PDPL requires the controller to notify the Data Office immediately and to inform affected data subjects. Processors must tell the controller as soon as they become aware. In the DIFC, Article 41(1) requires notice to the Commissioner as soon as practicable in the circumstances, and processors must notify controllers without undue delay under Article 41(2). ADGM is stricter in form, with a 72-hour deadline and a duty to give reasons for any delay.
Saudi Arabia, Qatar, Bahrain and Oman
Saudi controllers file through SDAIA's National Data Governance Platform within 72 hours. Government bodies and critical infrastructure operators must also report cyber incidents to the NCA under control 2-13-3 of ECC-2:2024. Qatar's regulator guidelines and Article 14 of the PDPPL set 72 hours. Bahrain's Resolution No. 43 of 2022 sets 72 hours from discovery. Oman goes furthest on individuals: where severe damage or high risk is likely, people must be told within the same 72 hours.
Designing one incident process
One practical approach is a single internal playbook timed to the strictest relevant clock. For an Indian company, that is the 6-hour CERT-In report. For a GCC-only group, a 72-hour plan covers the fixed deadlines, with the UAE onshore requirement of immediate notice treated as the trigger to file as soon as facts allow. Pre-register on filing platforms such as SDAIA's, keep contact details for every regulator in the playbook, and write processor notice duties into every vendor contract.
- Fix the earliest clock first: 6 hours for CERT-In
- Prepare regulator contacts and filing accounts in advance
- Draft individual notices in the needed languages
- Require processors to report to you without delay
- Record when you became aware, discovered or noticed the breach
Before the next incident
Run a tabletop exercise that starts the clock at a realistic time, such as late on a Friday, and see whether the first report can go out within 6 hours. Keep a log of decisions, as several regimes ask for reasons when a notice is late. Your public privacy policy should also commit to these notices. XDQ xAgents (https://xagents.xdqlabs.com) checks whether a policy includes the breach commitments each regime expects. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Frequently asked questions
What is the fastest breach reporting deadline in India?
CERT-In's Directions require cyber incidents to be reported within 6 hours of noticing them. They have applied since 28 June 2022. From 13 May 2027, DPDP Rule 7 adds a detailed report to the Data Protection Board within 72 hours.
Which GCC countries use a 72-hour breach deadline?
Saudi Arabia, Qatar, Bahrain, Oman and the ADGM free zone all use 72 hours. Onshore UAE requires immediate notice to the Data Office, and the DIFC requires notice as soon as practicable in the circumstances.
Do I have to tell customers about a breach in Oman?
Yes, where severe damage or high risk is likely. Oman's Executive Regulations require affected individuals to be told within the same 72 hours given for notifying MTCIT, which is stricter than many regimes.
Is DPDP breach reporting already in force?
Not yet. DPDP Rule 7 applies from 13 May 2027, but CERT-In's 6-hour reporting rule already applies. This guide is general information, not legal advice. Confirm with a qualified lawyer.
Sources
- Nishith Desai Associates: CERT-In Directions of 28 April 2022, Nishith Desai Associates, 2022
- DPDP Rules 2025, Rule 7 text (dpdpa.com), dpdpa.com, 2025
- Bird & Bird: UAE Federal Decree-Law on Personal Data Protection compared with GDPR, Bird & Bird, 2021
- DIFC Data Protection Law No. 5 of 2020 (official text, government.ae), UAE Government Portal (government.ae), 2020
- Taylor Wessing: New ADGM data protection law, key changes, Taylor Wessing, 2021
- DLA Piper Data Protection Laws of the World: Saudi Arabia, DLA Piper
- Clyde & Co: Regulatory guidelines on the Qatar Personal Data Protection Law, Clyde & Co, 2021
- Trowers & Hamlins: Bahrain enhances its data protection regime (2022 resolutions), Trowers & Hamlins, 2022
- Clyde & Co: Oman issues Executive Regulations to the PDPL, Clyde & Co, 2024
- NCA Essential Cybersecurity Controls ECC-2:2024 (official), National Cybersecurity Authority (NCA), 2024
