Personal Data Protection Law — notification of personal data breaches

Controllers must notify the Ministry of Transport, Communications and Information Technology within 72 hours of a personal data breach that may pose a risk to data subjects' rights, stating the nature and impact of the breach and the mitigation measures taken, and must notify affected data subjects where the breach is likely to cause them serious harm. The date that matters commercially is February 5, 2026: the transition period introduced by the Royal Decree and its Executive Regulation ended then, so the PDPL is now fully enforceable rather than in a grace period. Marked 'check': the operative texts are Arabic-language originals and the deadlines were triangulated across independent legal-reference sources.