UAE Data Breach: Does the Company Have to Tell You?

A company that loses control of your personal data must tell you when the breach would harm the privacy, confidentiality or security of that data, and it must tell you what measures it has taken. That duty sits in the UAE federal personal data protection law, Federal Decree-Law No. 45 of 2021, in force since 2 January 2022. In practice, knowing what to do after a data breach in the UAE comes down to four moves: ask the company in writing what happened, secure your accounts, complain to the federal data regulator if the answer is poor, and report any fraud through the police channels listed below.

Does a company have to tell you about a breach?

Yes, when the breach would prejudice the privacy, confidentiality or security of your data. The controller, meaning the organisation that decides why and how your data is used, must notify the regulator when it becomes aware of such a breach. It must also notify you as the data subject and tell you the measures it has taken. A processor, meaning a company handling data on the controller’s behalf, must tell the controller as soon as it becomes aware, and the controller then informs the regulator.

The notification duty carries no written count of hours or days. The period, and the measures and requirements for the notice, are left to Executive Regulations, so do not expect the law text to hand you a countdown.

What must the notice to the regulator contain?

• The nature, form and causes of the breach, and the approximate number and records affected.
• The details of the company’s appointed data protection officer.
• The potential and expected effects of the breach.
• The corrective measures taken or proposed.
• Documents recording the breach and the corrective actions.

The notice to you is shorter: that a breach affecting your data has happened and which measures the company has taken.

What rights do you have after a breach?

Who takes complaints, and must you go to the company first?

You can complain directly to the federal data regulator, and the law does not require you to complain to the company first. The regulator examines the complaint in coordination with the controller and the processor, and the law states no deadline for filing it. The regulator appears as the UAE Data Office on the UAE government portal and as the UAE Data Bureau in the law’s own text.

If you disagree with the regulator’s decision, you can submit a written grievance to its Director General within 30 days of being notified, and the decision on the grievance is due within 30 days. Penalty amounts are not written into the law: the Council of Ministers issues the list of violations and administrative penalties by decision.

Which organisations fall outside this law?

Six groups are excluded: government data and governmental entities that control or process personal data, personal data held by security and judicial authorities, individuals processing data for personal purposes, personal health data that has its own protection legislation, personal banking and credit data that has its own legislation, and companies in free zones that have special data protection legislation. If your breach involves one of these, a different regime applies, so check which one governs the organisation before choosing where to complain.

What should you do after a data breach, step by step?

1. Keep the company’s message and note which details were exposed (name, Emirates ID, phone, card, password).
2. Change the password on the affected account and on every other account where you reused it, and switch on two-step verification where it is offered.
3. Write to the company and ask what data was affected and which measures it has taken. The right to receive information covers the actions taken in the event of a breach.
4. Ask for correction, erasure or restriction where it applies to your data.
5. If the answer is missing or poor, complain to the federal data regulator.
6. If anyone uses your details to defraud you, report it through the channels below.

Where do you report fraud that follows a breach?

The UAE government portal lists four online channels for reporting cybercrime: the eCrimes platform in the MoI UAE app of the Ministry of Interior, the eCrime website of Dubai Police, the aman service of Abu Dhabi Police, and the My Safe Society app of the federal Public Prosecution. You can also go to the nearest police station or call 999. Victims of online fraud are told not to give in to threats and to report the incident immediately.

One practical step: save those four channels on your phone today, then read our stop, verify, act routine for UAE online scams so you know the order to follow when a suspicious message arrives.

Where to go next

• UAE online scam safety: stop, verify, act and where to report
• Why sharing a copy of your Emirates ID is risky
• How the UAE ranks among Gulf cyberattack targets in 2026