United Arab EmiratesFederal Decree-Law on the Protection of Personal Data, breach notification
Federal Decree-Law No. 45 of 2021, Art. 9
In force since .
A breach notification rule binding private bodies.
- Audit expectation
- none
What it requires
- An app that is a Controller and suffers a breach of the personal data of an individual in the onshore UAE that would prejudice the privacy, confidentiality and security of that data must notify the Bureau at the time it becomes aware of the breach; the Decree-Law defers the specific notification window to Executive Regulations whose text could not be confirmed at primary source, so an app should not assume a specific hour count without checking current regulator guidance.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- What period applies to a Controller's notice to the Bureau and to the Data Subject under Article 9, which requires notice 'within the period and in accordance with the measures and requirements set by the Executive Regulations of this Decree by Law'?
What it makes you log
Logging duty
Article 9 makes the controller notify the Bureau of a breach at the time it becomes aware of it, within the period the Executive Regulations set, with a description of the breach, the corrective measures and the documents of the violation attached, and tells the controller to notify an affected data subject; a processor notifies the controller. That is a duty to notify, and the attachments are content of the notification; the Article does not tell the controller to document every breach or to keep a register of them. Article 9(4) has the Bureau verify the reasons for the violation after it receives a notification, a review of an incident report and not of a kept record.
- Kind
- None
- As of
What this law does
Art. 9 requires the Controller to notify the Bureau of a breach that would prejudice the privacy, confidentiality, or security of personal data, at the time it becomes aware of the breach, within a period the Decree-Law itself defers to the Executive Regulations. No fixed number of hours or days is stated in the Decree-Law's own text; the timeline is not established pending the unconfirmed Executive Regulations (see the jurisdiction summary).
Data Subject notification is also required where the breach meets a threshold the Decree-Law's text does not fully set out in the provisions read.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .