Incident and Breach Reporting Map

One incident can trigger several reporting duties. They are parallel duties: notifying SDAIA does not discharge NCA or sector reports, and the October 2026 draft's "without prejudice" wording keeps SDAIA notification separate from NCA and sector reports. Position as at 20 October 2026.

Regime	Who	Trigger	To	Timing	Status
PDPL Implementing Regulation (IR) Art 24 (current)	Controllers	Incident that may cause harm	SDAIA (platform)	72 hours from awareness	In force
PDPL IR Art 24 (draft)	Controllers	Any breach, damage or unauthorised access, without prejudice to NCA duties	SDAIA	72 hours	Draft
PDPL IR Art 24(5)	Controllers	Damage to data or conflict with rights	Data subjects	Without undue delay	In force (unchanged in the draft)
NCA ECC-2:2024	Government entities, critical national infrastructure	Cybersecurity incidents	NCA	No hours set in ECC	In force
NCA NCNICC-1:2025	Non-CNI private entities identified by the NCA	Incident occurs	NCA	No hours set	In force
NCA CCC-2:2024	Cloud providers	Incidents affecting tenants	Tenant	Real time	In force
NCA NFCISIR (draft)	All public and private entities	Actual or suspected incident	Haseen portal	Immediate; 2, 12, 48 or 72-hour tiers for NCA requests	Draft
CST CCSPR v4 Art 3-3-8	Cloud providers	Breach	CST and subscribers	Without undue delay	In force
Saudi Central Bank (SAMA) Cyber Security Framework 3.3.15 / BCM	SAMA-regulated entities	Medium or high incidents	SAMA	Immediately	In force
CMA Cybersecurity Guidelines	Capital market institutions	Incident	CMA	Immediately; report after recovery	In force
Saudi Health Information Exchange (HIE) Policies	HIE participants	Breach	Officer, then SeHE, then participants and individuals	2 business days, then 2, 10 and 30 days	In force (status of SeHE to verify)

Points to note

These are parallel duties. A report to the NCA or a sector regulator does not replace notice to SDAIA, and the reverse.
The current SDAIA breach guide uses the harm threshold of current IR Art 24; it would no longer match if the draft is adopted.
The HIE 30-day notice to individuals may sit uneasily with the PDPL "without undue delay".

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21