How fast must a data breach be reported under the Saudi PDPL?

Within 72 hours. The PDPL Implementing Regulation requires notifying SDAIA within 72 hours of becoming aware of a breach that could harm the personal data or the people it belongs to. Those people must be told too, without undue delay and in plain language.

The clock runs from awareness, so a website needs a plan before anything happens: who decides whether a breach could cause harm, who notifies SDAIA, and how the affected people are told. SDAIA confirmed 48 enforcement decisions in its January 2026 announcement, and the categories it named include inadequate safeguards.

The breach duty sits outside the cookie banner, alongside answering data requests within 30 days and checking transfers abroad. Administrative fines reach SAR 5,000,000, doubling to SAR 10,000,000 for a repeat violation.