PDPPL breach notification: what NCSA's guideline says

The 72-hour expectation

According to NCSA's guideline, controllers must notify the National Cyber Governance and Assurance Affairs and individuals of a personal data breach within 72 hours of becoming aware of it, where the breach can cause serious damage to individuals. The guideline accepts that you may not have the full picture within 72 hours; in that case it expects you to share what you know and explain when the rest will follow.

Processors

Processors must tell the controller about a breach. The guideline states that a processor failing to inform a controller where a risk arises could face a penalty of up to QAR 5,000,000 per violation.

Maximum penalties the guideline mentions

• Failure to report a breach to the regulator or individuals as required: up to QAR 1,000,000 per violation.
• Failure to put appropriate precautions in place for the nature and importance of the data: up to QAR 5,000,000 per violation.

These are ceilings stated in the guideline, not typical outcomes.

Other points in the guideline

• The guideline encourages controllers to rehearse their breach response on a regular basis and treat it as part of their wider security set-up.
• NCSA publishes a breach notification form alongside the guideline (NCSA guidance hub for regulated entities).

Where a website scan fits

A scan can't tell you whether you've had a breach. It can show public signals linked to the "precautions" theme, such as missing HTTPS redirects, missing security headers or exposed files. See our methodology. For advice on a specific incident, consider asking a licensed lawyer and a qualified security professional.

QFC firms

The QFC has its own regime and regulator; see our QFC summary.