GCC breach notification: the 72-hour norm and its gaps

Published 2026-10-18 · 6 min read · Samtaro Security

This summary draws on a comparison ClairSec published on 10 October 2026. ClairSec says plainly that it is not a law firm, and that for several markets it relied on law-firm commentary rather than the legal text (ClairSec). We repeat its confidence notes.

Market	As reported	How well sourced (per ClairSec)
Saudi Arabia	Notify SDAIA within 72 hours of a breach likely to cause harm (Implementing Regulations, Art. 24). Draft amendments under consultation would drop the harm test.	Regulator service describes the rule
Qatar	The statute requires informing the individual and the competent department of a breach likely to cause serious damage, with no hour count. NCSA's guideline expects notification of the regulator and individuals within 72 hours of becoming aware, where the breach can cause serious damage (NCSA breach notification guideline).	Law text and NCSA guideline
Oman	Notify the regulator within 72 hours of a breach that may put data subjects' rights at risk. Fully enforceable from 5 February 2026.	Law-firm commentary; not checked against the decree
Bahrain	Notify the Personal Data Protection Authority within 72 hours, with a documented reason if late.	Law-firm commentary
UAE (federal)	Breach reporting required; the period is left to executive regulations. No deadline stated.	Commentary only
Kuwait	No general data-protection statute found. A telecom-regulator rule for licensed providers is described as 24-hour reporting.	Commentary; sources disagree

For QFC firms, the QFC Data Protection Regulations set a 72-hour deadline to notify the QFC DPO (Art. 31(1)). The DPO has penalised late notification (QFC summary). In the EU, GDPR Art. 33 requires notice without undue delay and, where feasible, within 72 hours.

Building a multi-country playbook

1. List each country you process data in, its regulator, and the trigger and timing that apply.
2. Plan to the strictest clock you face.
3. Make your processors' notification duty to you shorter than your own deadline. The QFC case shows a processor's delay doesn't stop the controller's clock.
4. Pre-draft notices to regulators and individuals.
5. Rehearse once a year: who decides, who notifies, who briefs the board.

This article is for general educational purposes and is not legal advice. Seek qualified counsel for your specific situation.