Personal Data Breach Notification

What personal data breach notification is

Personal data breach notification (الإبلاغ عن تسرب البيانات الشخصية) is the duty of the controller (جهة التحكم), the party that decides why and how personal data is processed, to notify the competent authority on learning of a breach. The controller must also notify the data subject when the breach would damage the data subject’s data or conflict with the data subject’s rights or interests. The basis is Article 20 of the Personal Data Protection Law (PDPL) (نظام حماية البيانات الشخصية). Article 24 of the PDPL Implementing Regulations sets out the detail.

An employer is the controller of its employees’ and applicants’ data. Paragraph 1 of Article 2 of the PDPL applies the Law to any processing of personal data about individuals that takes place in the Kingdom. Paragraph 2 of that Article excludes only an individual’s processing of personal data for purposes that go no further than personal or family use, on this condition in the Arabic text: «ما دام أنه لم ينشرها أو يفصح عنها للغير». SDAIA’s official English translation renders the condition as “as long as the Data Subject did not publish or disclose it to others”. The PDPL Implementing Regulations define personal and family use.

An employer that keeps employee files and payroll statements is within the duty. A provider that processes that data for the employer, such as a payroll system provider, is a processor (جهة المعالجة).

What counts as a breach

Article 1 of the PDPL Implementing Regulations defines a breach as any incident that leads to disclosure of personal data, damage to it or unlawful access to it. Intent does not matter, and neither does the means, automated or manual. The definition covers:

• Disclosure. Making the data available to anyone other than the controller and the processor, for example by sending a payroll statement to a wrong email address.
• Damage. Damage to the personal data (تلف). The definition does not say that anyone must have read the data. That is our reading, because the text sets no such condition.
• Unlawful access. Access by a person with no authority, whether an employee or an outsider.
• Accidents and paper records. The definition covers human error as well as deliberate acts, and manual means as well as automated ones. A paper file that reaches someone not entitled to see it falls within it, as does a compromised computer.

The wider duties of which this notification duty is part are covered under employee data privacy.

What Article 20 of the PDPL says

SDAIA’s official English translation of the PDPL gives paragraph 1 of Article 20 of the PDPL as:

The Controller shall notify the Competent Authority upon knowing of any breach, damage, or illegal access to personal data, in accordance with the Regulations.

It gives paragraph 2 of Article 20 of the PDPL as:

The Controller shall notify the Data Subject of any breach, damage or illegal access to their Personal Data that would cause damage to their data or cause prejudice to their rights and interests, in accordance with the Regulations.

Both paragraphs leave the detail to the Regulations, so neither the deadline nor the content of the notice is set in the PDPL. It does not name the competent authority either: Article 1 of the PDPL defines that authority as the body designated by a decision of the Council of Ministers. In practice that body is the Saudi Data and AI Authority (SDAIA), whose national data governance platform offers a service titled «إشعار تسرب بيانات شخصية» (notification of a personal data breach). The PDPL Implementing Regulations do not specify the channel for the notification.

Article 24 of the PDPL Implementing Regulations

Article 24 of the PDPL Implementing Regulations has five paragraphs. Paragraph 1 opens with the deadline, which reads in Arabic:

تُشعر جهة التحكم الجهة المختصة في حالة وقوع حادثة تسرّب للبيانات الشخصية خلال مدة لا تتجاوز (72) ساعة من وقت علمها بالحادثة، إذا كان من شأن تلك الحادثة الإضرار بالبيانات الشخصية أو صاحب البيانات الشخصية أو كانت تتعارض مع حقوقه أو مصالحه

The English rendering is ours, not an official translation. When a breach incident occurs, the controller notifies the competent authority within 72 hours of the time it learns of the incident, if the incident is liable to harm the personal data or the data subject, or conflicts with the data subject’s rights or interests. The five paragraphs say:

• Paragraph 1: notice to the competent authority. The notice has five items. The first describes the incident, with its time, date and manner and the time the controller learned of it. The second gives the categories and the actual or approximate numbers of the data subjects concerned, and the type of data. The third describes the possible risks, the actual or possible impact, the measures taken to prevent or limit the effects, and the future measures to stop the incident happening again. The fourth states whether the data subject has been or will be notified. The fifth gives contact details for the controller or its data protection officer if it has one, or for any other person with information about the incident.
• Paragraph 2: information that follows later. If the controller cannot provide some of the required information within 72 hours of learning of the breach, it must provide it as soon as possible and attach the reasons for the delay.
• Paragraph 3: retention. The controller keeps a copy of the reports it submitted to the competent authority, documents the corrective measures taken in connection with the breach, and keeps any related supporting documents. The paragraph states no retention period.
• Paragraph 4: other duties. Article 24 of the PDPL Implementing Regulations does not affect any duty of the controller or the processor to file a report or notice about breach incidents under rules issued by the National Cybersecurity Authority or under any other law or regulation in force in the Kingdom.
• Paragraph 5: notice to the data subject. When the incident is liable to damage the data subject’s data or to conflict with the data subject’s rights or interests, the controller must notify the data subject without undue delay, in simple and clear language. The notice describes the incident and the risks, states the measures taken, gives the controller’s name and a means of contact, and offers recommendations or advice that help the data subject avoid the risks or reduce their effects. The paragraph does not name a means of notifying the data subject.

Paragraph 1 ties the 72 hours to a condition: the incident must be liable to cause harm or to conflict with rights and interests. Article 20 of the PDPL speaks of notifying the competent authority on learning of a breach, without that condition, and refers to the Regulations. The PDPL Implementing Regulations do not state what makes an incident liable to harm, or what counts as conflicting with rights and interests. In the sources we reviewed, we found no text that deals with a breach incident that is not liable to cause harm, so it remains open whether a notice is required for it and within what time.

A worked example: a payroll statement sent to the wrong address

On the morning of Thursday 8 October 2026, an accountant mistakenly sends an external email address a monthly payroll statement covering 120 employees. The statement shows each employee’s name, identity number and bank account number. The finance manager learns of the mistake at 09:00 the same morning. The dates and numbers are invented to illustrate the calculation.

• Is it a breach? Yes. Under the definition in the PDPL Implementing Regulations, it is an unintended disclosure of personal data by automated means. Whether it is liable to cause harm depends on the facts of the incident. In our assessment, identity numbers and bank account numbers make harm more likely, and the text sets no standard for harm.
• The deadline. The 72 hours run from the time the controller learned of the incident, which here is from Thursday at 09:00 to Sunday 11 October 2026 at 09:00. Paragraph 1 of Article 24 of the PDPL Implementing Regulations does not exclude Friday and Saturday from the hours, so the count runs through both days.
• The content of the notice. It gives the time, date and manner of the incident, the group concerned (120 people, as an actual or approximate number) and the type of data. It describes the risks and the measures taken, such as asking the recipient to delete the message, and it gives contact details.
• The employees. If the incident is judged liable to harm them, the establishment must notify them without undue delay, in simple language. The notice describes the incident and the measures taken and gives practical advice, such as monitoring their bank accounts.
• Documentation. Under paragraph 3 of Article 24 of the PDPL Implementing Regulations, the establishment keeps a copy of the report it submitted and documents the corrective measures, such as its correspondence with the wrong recipient.

The calculation applies paragraph 1 to invented facts and is not a procedure laid down in the PDPL Implementing Regulations. Paragraph 1 counts from the time the controller learned of the incident. The text does not say whether that is when the mistake is made, when it is discovered or when its seriousness is assessed, and it does not say what happens when a processor learns of an incident before the controller does.

When the breach occurs at a processor

Paragraph 1 of Article 17 of the PDPL Implementing Regulations lists clauses that the agreement with a processor must contain. A processor can be a service provider that processes employee data for the establishment. One required clause is the processor’s commitment to notify the controller of a personal data breach, as the Law and its regulations provide, and without undue delay. Article 17 sets no figure in hours for that notification. It lists other required clauses, which are a separate subject.

The same Article makes the controller responsible for periodic checks that the processor complies. A processor that breaches the controller’s instructions or the agreement is deemed to be in the position of a controller and responsible for the violation of the PDPL. The agreement that records terms of this kind is covered under data sharing agreement.

The personal data protection officer

Paragraph 3 of Article 32 of the PDPL Implementing Regulations lists, among the duties of a controller’s personal data protection officer, notifying the competent authority of personal data breach incidents. Paragraph 1 of the same Article states the cases in which an officer must be appointed, and those cases are a separate subject. Where there is no officer, the duty to notify rests on the controller under Article 20 of the PDPL.

Prevention through security

Article 23 of the PDPL Implementing Regulations requires the controller to take the organisational, administrative and technical measures needed to secure personal data and protect data subjects’ privacy. These include applying the security and technical measures needed to reduce the risk of a breach. They also include complying with the controls of the National Cybersecurity Authority, or with recognised cybersecurity best practice where the controller is not bound by the Authority’s controls. Notification applies after an incident, and Article 23 of the PDPL Implementing Regulations applies before one.

Arrangements that differ from breach notification

• Authorised data sharing. The establishment decides to disclose data to another party, as covered under data sharing agreement. A breach happens without any decision to disclose.
• Restricted access within the establishment. This concerns how permissions are allocated, and it becomes a breach if the access is unlawful. Employee self service gives an example of access limited to the data that concerns the employee.
• A personal devices policy. It is a preventive rule for data that passes through an employee’s personal device, covered under BYOD policy. Losing a device that holds employee data may amount to disclosure or unlawful access, depending on what happened to the device.
• A general security incident. It may not involve personal data. A system outage that neither disclosed nor damaged any data is outside this notification duty.

The PDPL has penal provisions for contravening it. They are separate from the notification duty described above.

What to document

These are practical recommendations, not conditions found in the Articles cited:

• An incident log. Record for each incident the estimated time it occurred and the exact time the establishment learned of it, because the period counts from the time of knowledge.
• A named responsible person. Decide who is told first in the establishment, who assesses the harm and who prepares the notice.
• A notice template. Prepare it in advance with the five items in paragraph 1 of Article 24 of the PDPL Implementing Regulations.
• Provider agreements. Make sure the agreement with each processor contains the clause on notifying the controller of a breach, as Article 17 of the PDPL Implementing Regulations provides.
• Keeping the evidence. Keep a copy of the report submitted and of the corrective measures taken, as paragraph 3 of Article 24 of the PDPL Implementing Regulations provides.
• A notice to employees. Prepare a template in simple language that contains the elements in paragraph 5 of Article 24 of the PDPL Implementing Regulations.

This is an explanation of the concept and of the statutory provisions cited, not legal advice.