Personal Data Breach Incidents Procedural Guide
Saudi Arabia · Guideline · Saudi Data & AI Authority (SDAIA)
Our summary
This guide establishes procedures for organizations to respond to personal data breaches under Saudi Arabia's Personal Data Protection Law. Controllers must notify SDAIA within 72 hours, contain the breach, notify affected data subjects, and maintain documentation of incidents and corrective measures. The guide covers breach notification methods, required notice content, and response stages aligned with international best practices.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
6 sections
Jump to a chapter
Introduction
This guide supports controllers in complying with Saudi Arabia's Personal Data Protection Law and its implementing regulations regarding data breaches. Controllers must notify SDAIA and affected data subjects when a breach occurs and has the potential to harm personal data or interfere with subject rights or interests. The guide outlines procedures to manage breaches and reduce their impact on data subjects.
Definitions
This section defines key terms used in the guide, including the Guide itself, SDAIA as the Saudi Data and AI Authority, and the Data Protection Officer as the individual appointed by a controller to oversee compliance with data protection law and handle data subject requests.
Scope
The guide applies to all organizations that are subject to Saudi Arabia's Personal Data Protection Law and its implementing regulations and serves as a framework for responding to data breaches across multiple stages.
STAGE ONE: SDAIA Notice
Controllers must notify SDAIA within seventy-two hours of discovering a breach that is likely to harm personal data or data subjects or violate their rights or interests, using the National Data Governance Platform. The notification must describe the breach, specify the categories and number of affected subjects, detail the risks and remedial actions, confirm whether subjects have been notified, and provide contact information for the controller or its data protection officer.
STAGE TWO: Breach Incident Containment
Data controllers must follow internationally recognised practices and applicable regulations to contain personal data breaches, which includes assessing what information was compromised and how many people were harmed. Controllers must promptly inform affected individuals if the breach causes harm to them or violates their interests, such as physical threats or financial loss, using their preferred communication channels or other means for large-scale incidents. The notification must clearly explain the breach, its risks, protective actions taken, and how to contact the controller, plus guidance for individuals to reduce potential harms.
STAGE THREE: Documentation
Controllers must keep records of all documents submitted to SDAIA related to the breach, the corrective measures undertaken, and supporting documentation. Controllers shall also implement all necessary corrective actions to contain the breach based on lessons learned from the incident.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 5 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 1 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Impact assessment, not covered
Data and privacy 1 of 4
- Data governance and quality, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 2 of 4
- Labelling of synthetic content, not covered
- Technical documentation, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 1 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 17 are shown.
STAGE ONE: SDAIA Notice 8 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers should notify SDAIA within seventy-two hours of discovering a breach expected to harm personal data or data subjects.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should use the National Data Governance Platform to submit breach notifications to SDAIA.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should register on the National Data Governance Platform to access the breach notification service.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should include in their breach notice a description of the incident including when it occurred, how it happened, and when they became aware of it.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should specify the categories and actual or approximate numbers of affected data subjects and the types of personal data involved.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should describe the risks from the breach, remedial actions already taken, and measures to prevent future recurrence.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should indicate in their notice whether data subjects have been or will be notified of the breach.
- ObligationApplies to: ControllerDrafted by the Index
Controllers should provide contact details for themselves, their data protection officer or another person with information about the breach.
STAGE TWO: Breach Incident Containment 7 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must set up procedures that align with international best practices and relevant laws to limit damage from personal data breaches.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must determine what types and volumes of personal data have been compromised in a breach.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must identify which individuals are affected based on the type of personal data that was breached.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must notify affected individuals without delay if a breach harms them or infringes their rights or interests, including physical or economic harm.
- Applies to: ControllerDrafted by the Index
Controllers may notify individuals by their preferred communication method, such as text message or email.
- Applies to: ControllerDrafted by the Index
Controllers may notify individuals through their website, social media accounts or media if the breach affects a large group at national level, provided the notice meets applicable law.
Applies when: large-scale incidents
- ObligationApplies to: ControllerDrafted by the Index
Controllers must include in notifications a clear explanation of the breach, the risks it poses, the steps taken to limit harm, and guidance on how individuals can protect themselves.
STAGE THREE: Documentation 2 controls
- ObligationApplies to: ControllerDrafted by the Index
Controllers must retain copies of all documents submitted to SDAIA regarding breach incidents, the corrective actions taken, and relevant supporting records.
- ObligationApplies to: ControllerDrafted by the Index
Controllers must implement all necessary corrective actions to contain breach incidents based on lessons learned from the incident.
Change history
No changes recorded since we began monitoring this policy.