Data breach in Kenya: the 72-hour notification duty

Section 43 of the Data Protection Act, 2019 requires data controllers to act quickly when personal data is compromised.

When to notify

Where there is a real risk of harm to data subjects, the controller must notify the Data Protection Commissioner within 72 hours of becoming aware of the breach. Processors must notify the controller without delay.

Affected data subjects must be informed in writing within a reasonable time, unless their identity cannot be established or the data was protected (for example, encrypted).

What to include

• a description of the breach and the categories of data affected,
• the likely consequences,
• measures taken or proposed to address the breach and mitigate harm, and
• a contact point for more information.

Steps to take immediately

1. Contain the breach — revoke access, isolate systems.
2. Assess what data and how many people are affected.
3. Notify the Commissioner and affected individuals as required.
4. Document everything, including decisions not to notify.
5. Review and fix the cause.

Penalties

The Commissioner can issue enforcement notices and administrative fines, and affected individuals may claim compensation.

This article is general information, not legal advice on your situation.

Get help from a verified advocate

This article is general information, not legal advice on your situation. If you need advice, describe your matter on Wakili Link and we will match you with a verified advocate who handles it.

• Regulatory & compliance lawyers in Kenya
• Data protection compliance
• How to verify an advocate in Kenya