Data Breach Notification in Kenya: The 72-Hour Rule Explained
When and how to report a personal data breach to the ODPC under the Kenya Data Protection Act, what to include, and when to tell the people affected.
· Reviewed by Danstan Akwiri, CISSP, CISA
Section 43 of the Kenya Data Protection Act, 2019 sets out what happens after personal data is compromised. Where a breach creates a real risk of harm to the people whose data it is, the data controller must notify the Data Commissioner within 72 hours of becoming aware of it, and must tell the affected people within a reasonable time unless their identity cannot be established.
Seventy-two hours is short. It covers weekends and public holidays, and it starts at awareness, not at the end of an investigation. This guide explains what counts as a breach, who must notify whom, what the notification must contain, and how to prepare so that the first day of a real incident is spent responding rather than looking for the right email address.
| Notify the Data Commissioner | Notify the people affected | |
|---|---|---|
| Who notifies | The data controller | The data controller |
| When it applies | Where there is a real risk of harm to data subjects | Where there is a real risk of harm, unless their identity cannot be established |
| Deadline | Within 72 hours of becoming aware | Within a reasonable time |
| If you are a processor | Tell the controller without delay, and within 48 hours | The controller decides and notifies |
| If you cannot give everything at once | Give what you have and send the rest in phases | Communicate in plain language as facts are confirmed |
What counts as a personal data breach
A breach is any security incident that leads to personal data being accidentally or unlawfully destroyed, lost, altered, disclosed or accessed. It is broader than hacking. A ransomware attack is a breach, but so is a laptop left in a matatu, an email containing a member list sent to the wrong recipient, an exposed cloud storage bucket, or a former employee who still has access to the customer database.
Availability counts too. If ransomware leaves patient or customer records unavailable, that is a breach even if no data was copied out, because people can be harmed by not being able to get at their own information.
When the 72 hours starts
The clock starts when the controller becomes aware that a breach has occurred: when you have a reasonable degree of certainty that personal data has been compromised. It does not wait for you to know the full scope, the root cause or the number of people affected.
That is why the Act allows notification in phases. If you know on day one that a database containing customer records was accessed but not yet how many records, notify within the 72 hours with what you know and follow up as the investigation develops. Waiting for a complete picture is the most common way organisations miss the deadline.
What the notification should contain
The notification to the Data Commissioner should let the ODPC understand the incident and judge the risk. At a minimum it should set out:
- A description of the breach: what happened, when, and how it was discovered.
- The categories of personal data involved and, where known, the approximate number of people and records affected.
- The likely consequences for the people affected.
- The measures taken or proposed to contain the breach and reduce its effects.
- The name and contact details of your Data Protection Officer or another contact point.
- Where you are notifying late, the reasons for the delay.
Telling the people affected
Where the breach poses a real risk of harm, the people whose data was compromised must be told within a reasonable time, in plain language they can act on: what happened, what data of theirs was involved, what you are doing about it, and what they should do now, such as changing a password, watching for phishing calls or contacting their bank.
Be specific and honest. A vague notice that "some information may have been accessed" generates more calls and more distrust than one that tells people exactly what was exposed and what to watch for. Keep a record of when and how each group was told.
If you are a data processor
If you process data on behalf of another organisation, such as a payroll provider, a software vendor hosting a client's system or an IT support firm, your duty is to tell the controller. The Act requires a processor to notify the controller without delay and within 48 hours of becoming aware of the breach. The controller then decides whether and how to notify the Data Commissioner and the people affected.
Your contracts should already say how this works: who you notify, through which channel, and what information you provide. If they do not, fix that before an incident, not during one.
How to be ready before it happens
Organisations that meet the deadline have usually decided the hard questions in advance. A short written breach response procedure, rehearsed once a year, removes most of the delay.
- Name who decides whether an incident is a notifiable breach, and who deputises when they are away.
- Keep a contact list: your DPO, legal adviser, IT and security responders, insurer, and the ODPC's current reporting channel.
- Prepare notification templates for the Data Commissioner and for affected people.
- Keep a breach register, including incidents you decided not to notify and why.
- Make sure logging is good enough to tell you what was accessed. Without logs you cannot scope a breach, and you will have to assume the worst.
Key takeaways
- Notify the Data Commissioner within 72 hours of becoming aware of a breach that creates a real risk of harm.
- The clock starts at awareness, not at the end of your investigation. Notify with what you know and follow up in phases.
- Tell the affected people within a reasonable time, in plain language, with steps they can take.
- Processors must tell the controller without delay and within 48 hours.
- A written, rehearsed breach procedure and decent logging are what make the deadline achievable.
Frequently asked questions
Do we have to report every data breach to the ODPC?
The duty to notify the Data Commissioner applies where the breach creates a real risk of harm to the people whose data is involved. Many incidents will meet that bar. If you decide a breach does not, record the incident and your reasoning in a breach register, because you may need to justify the decision later.
Does the 72 hours include weekends and public holidays?
Treat it as 72 hours of clock time from when you became aware, including weekends and holidays. Plan your response procedure on that basis, with someone able to make the call outside office hours.
What if we do not yet know how many people are affected?
Notify within the deadline with the information you have, say that the investigation is continuing, and provide further information in phases. Incomplete but timely is far better than complete but late.
We were hit by ransomware but no data was copied. Is that a breach?
Very likely, yes. Loss of availability of personal data is a breach, and you often cannot be sure no data was taken until forensic work is complete. Many ransomware groups now copy data before encrypting it.
Can Neurobyte help us respond to a breach?
Yes. We help contain the incident, establish what was accessed from logs and forensic evidence, prepare the notification to the Data Commissioner and the message to affected people, and then fix the weakness that was exploited.