Saudi Arabia PDPL 20: Notify SDAIA of breaches within 72 hours and data subjects without undue delay

What does 20 require?

The Controller notifies the Competent Authority on learning of a breach, damage or illegal access to personal data, and notifies data subjects where it may harm their data or conflict with their rights or interests (Law 20). Notice to the Authority is due within 72 hours of awareness where the incident may harm the data or data subjects, describing the incident with its time, date, circumstances and time of awareness; data categories, actual or approximate numbers affected and data types; risks, impact and measures taken and planned; whether data subjects were told; and contact details; missing information follows as soon as possible with reasons; copies, corrective measures and evidence are kept; NCA and other reporting duties still apply. Data subjects are told without undue delay in simple, clear language with a description, the risks and measures, contact details and advice (IR 24).