Cyber Incident Notification Requirements Across the MENA Region

5 min 48 sec

Written by

David Yates

Partner, Head of Digital & Data

d.yates@tamimi.com View LinkedIn Profile

Courtney Mitchell

Associate

C.Mitchell@tamimi.com View LinkedIn Profile

A cyber incident resulting in a personal data breach can affect individuals across several jurisdictions. This may trigger multiple notification obligations, each with its own threshold, timeframe, reporting authority, and requirements.

Following a cyber incident, organisations must establish which laws apply, which authorities need to be notified, whether affected individuals must be informed, and when each notification must be made. This assessment often needs to take place while the organisation is still investigating the nature and extent of the breach.

For businesses with a regional footprint, a single incident could affect individuals across several jurisdictions and, whilst the underlying breach may be the same, the legal response may differ.

Reporting requirements across the MENA region

Data protection laws across the MENA region have developed significantly in recent years, but breach notification requirements vary across jurisdictions. The applicable notification threshold, timeframe, and reporting requirements vary between countries and, in some cases, between regulatory regimes within the same country.

For instance, under the Saudi Personal Data Protection Law and its Implementing Regulations, a controller must notify the competent authority within 72 hours of becoming aware of a personal data breach where the incident could cause harm to personal data, the data subject, or conflict with the data subject’s rights or interests. Affected data subjects must also be notified without undue delay where the breach may cause damage to their data or prejudice their rights or interests.

The UAE’s federal Personal Data Protection Law contains breach notification requirements, while the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) operate separate data protection regimes.

Under the DIFC Data Protection Law, a controller must assess whether a breach compromises an individual’s confidentiality, security, or privacy and, where the relevant threshold is met, notify the Commissioner as soon as practicable in the circumstances. There is no fixed statutory deadline equivalent to 72 hours. Where a breach is likely to result in a high risk to an individual’s rights or security, affected individuals must also be notified as soon as practicable.

By contrast, under the ADGM Data Protection Regulations 2021, a controller must notify the Office of Data Protection without undue delay and, where feasible, no later than 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to affected individuals.

Egypt’s Personal Data Protection Law imposes similarly short deadlines. Under the Personal Data Protection Law and its Executive Regulations, a Controller or Processor must notify the Personal Data Protection Center within 72 hours of becoming aware of a personal data infringement, with immediate notification required where the infringement relates to national security considerations. In all cases, affected data subjects must then be notified within three business days of the Center having been notified, using the communication method the data subject specified when providing consent to the collection of their data.

These differences have practical implications for regional organisations. Compliance with the notification requirements in one jurisdiction will not necessarily satisfy obligations elsewhere, and notification may be required before the full circumstances of the breach are established. Organisations should therefore record when they first became aware of the breach and maintain a clear record of their assessment and notification decisions, as this may be important when determining whether applicable notification deadlines have been met.

Sector-specific reporting

Organisations in regulated sectors may face additional notification obligations imposed by a sector regulator separate from and in addition to those under the applicable data protection law. This is particularly relevant in sectors such as financial services, healthcare, and critical infrastructure.

For example, an insurance company operating in the UAE may be licensed or regulated by the Central Bank of the UAE (CBUAE) as well as the relevant health authority, such as the Department of Health in Abu Dhabi or the Dubai Health Authority, depending on its activities. A single cyber incident may therefore trigger parallel reporting obligations under the applicable data protection and sector-specific regimes.

By way of illustration, a personal data breach affecting an insurance company operating across these regulatory frameworks may require the organisation to consider:

• Data protection reporting: notification to the applicable data protection authority where the relevant threshold for reporting a personal data breach is met;
• CBUAE reporting: notification to the CBUAE where the incident falls within the applicable customer data or cybersecurity incident reporting requirements; and
• Health authority reporting: notification to the relevant health authority, such as the Department of Health or Dubai Health Authority, where the incident involves protected health information and the applicable reporting threshold is met.

Businesses may need to assess an incident under both its general data protection law and the sector-specific regime applicable to its activities. The thresholds and timeframes under these regimes may not be aligned. Organisations should therefore identify sector-specific reporting obligations at the outset of an incident rather than assuming that a notification made to the relevant data protection authority will satisfy all applicable regulatory requirements.

The ongoing nature of a data breach notification

The circumstances of a personal data breach are often not fully known when a notification deadline arises. An organisation may know that a breach has occurred without yet knowing the full extent of the compromise, the categories of data affected, or the number of individuals impacted. The fact that an investigation remains ongoing does not necessarily remove the obligation to notify within the applicable timeframe.

Organisations should therefore provide the information available at the time of notification and supplement the notification as further details become available. This allows the organisation to meet applicable notification requirements without waiting for the investigation to be completed, while ensuring that regulators and, where applicable, affected individuals receive updated information as the position becomes clearer.

Preparation matters before the breach occurs

A personal data breach is not the ideal time to determine for the first time which notification rules apply to an organisation. Businesses operating across the MENA region should maintain a clear breach response framework identifying, for each relevant jurisdiction:

1. The applicable regime. Which data protection law applies to the relevant entity, processing activity, and affected individuals?
2. The notification threshold. What type or level of risk triggers notification to the regulator?
3. The notification deadline. When does the relevant period begin, and how quickly must notification be made?
4. Individual notification requirements. In what circumstances must affected individuals be notified, and within what timeframe?
5. Notification content. What information must be provided to the regulator and, separately, to affected individuals?
6. Internal responsibility. Who is responsible for assessing the breach, making the notification decision and approving communications?

It is equally important to establish a clear internal process for recording the key events following an incident. In particular, businesses should document when the breach was first identified, when it was escalated internally, what was known at each stage, and when decisions regarding notification were made. This record can be important where a regulator subsequently asks why notification was made at a particular time or why the organisation initially concluded that notification was not required.