When a personal data incident occurs, two obligations start at once. The regulator expects notification under the Personal Data Protection Law (PDPL), supervised by SDAIA, and your insurer expects notice under the policy. For PDPL breach notification cyber insurance 72 hours is the working window many organizations plan around, but the two obligations are different in content, audience and consequence.
This article sets out four steps to complete in the first 72 hours and the evidence that shows you did so. Always read your own policy wording and the PDPL implementing regulations, as the precise windows and content requirements are set there and not in this article.
Why the two timelines must be managed separately
A cyber policy usually makes timely notice a condition of cover. If notice is late, the insurer may rely on that condition to reduce or decline a claim. PDPL, by contrast, places a duty on the controller to notify the competent authority when a breach could harm individuals or affect their rights. It also sets expectations about what the notification contains.
The risk is confusion. A team may assume that notifying SDAIA satisfies the insurer, or that telling the broker informally is enough. Neither is safe. Each notice goes to a different party, with different content, and each needs its own record.
Step 1: Notify the insurer and broker with facts, not root cause
The first notice should be short and factual. State what is known, when it was detected, which systems appear affected, and whether personal data may be involved. Do not speculate on cause or attribution. Early statements of root cause are often revised, and an inaccurate statement can later be read against you.
Send the notice in the manner the policy specifies, usually to both the insurer and the broker, and keep the sent message. Note any acknowledgement or reference number you receive.
Step 2: Prepare the preliminary report to SDAIA if personal data is affected
If personal data is affected, begin the preliminary report to SDAIA under PDPL. Confirm the exact timeline and required content in the law's implementing regulations and any current SDAIA guidance. Typically, the report describes the nature of the incident, the categories and approximate volume of data subjects and records, likely consequences, and the measures taken or proposed.
Keep the facts in this report consistent with those given to the insurer. Differences between the two will draw questions, even where both are accurate for their time. Where facts are still uncertain, say so in both documents.
Step 3: Engage the insurer's panel firm
Most policies require that forensic and response work be done by an approved panel firm, or that any other firm be approved in advance. Using a non-approved firm without consent can put the related costs outside cover.
- Confirm which panel firms the policy names.
- Obtain written approval before any appointment outside the panel.
- Keep the appointment letter showing date, scope and the party that instructed the firm.
- Record the time of first contact with the panel firm.
Legal counsel should also confirm how privilege is handled in the forensic engagement, particularly where findings may feed into the regulatory report.
Step 4: Start the cost record on day one
Claims are paid against documented loss. Open a cost record when the incident is declared, not after it is contained. Record internal time, external fees, system restoration, notification costs and any business interruption as they occur. Retroactive reconstruction is slower and is more readily challenged by an adjuster.
Separate costs that are likely to fall within cover from those that are not, and note any retention that applies. Do not discard a cost because it seems minor; the policy's sub-limits and waiting periods decide what counts.
The evidence checklist insurers expect
The aim is a file that lets an adjuster verify, without asking, that you acted in time and followed the policy conditions. A practical checklist:
- Timestamped notices. The sent email or portal submission to the insurer and broker, with headers intact, plus any acknowledgement.
- Incident log extracts. Detection time, escalation decisions, and the moment the incident was declared, taken from the log rather than recalled afterwards.
- SDAIA submission record. The preliminary report as filed, the date and time of filing, and any confirmation.
- Panel-firm appointment letter. Showing date, scope, instructing party and, where relevant, insurer approval.
- Cost spreadsheet. A running record with date, description, supplier, amount and supporting invoice reference.
- Decision record. A short note of who decided what and when, especially where a deadline was close.
Keep original files in a form that preserves metadata. Screenshots alone are weaker than the underlying messages.
Common reasons notices fail
- The clock is assumed to start at confirmation, when the policy says discovery or suspicion.
- Notice goes to the broker only, or to a general mailbox, and not to the address in the policy.
- The first message includes a root-cause theory that is later disproved.
- Facts in the insurer notice and the regulatory report diverge without explanation.
- Costs are tracked in several places and cannot be reconciled.
Many of these can be addressed before an incident by reviewing the policy conditions and writing them into the incident response plan, so the notification steps are part of the playbook and not a separate task.
How we support this
Our Cyber Claims and Incident Support service helps you meet the policy conditions: timely notification, panel firms, cost records and the evidence the insurer needs to pay. The work follows four stages: notify the insurer and broker within the policy window, coordinate panel firms and approvals, record costs, losses and evidence, and prepare the claim and follow up with the adjuster.
The deliverables are a notification record, a claim file with evidence, and loss quantification. Involvement is as needed and is measured in hours. We do not replace the insurer's panel firm. We coordinate with the panel and protect your interests alongside them. If the incident has already happened, we can still help, although earlier involvement protects the claim best.
Before an incident, our Cyber Insurance Coverage Review compares your policy with your actual risks, including conditions and exclusions, and our Insurer Questionnaire and Underwriting Support helps keep proposal answers accurate and backed by evidence.
Closing
The first 72 hours are easier when the four steps and the evidence format are agreed in advance. If you want your notification process tested against your policy and PDPL obligations, or need support on a live incident, speak to us about Cyber Claims and Incident Support.
