When section 43 applies
Section 43 of the Data Protection Act, 2019 applies where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the data subjects. Lost laptops, misdirected emails with customer records, ransomware and a staff member browsing records without a reason can all qualify.
Not every incident is notifiable. Encrypted data whose key was not exposed, for example, may carry no real risk of harm. The decision, and why you made it, is what the ODPC will examine later, so write it down either way.
The deadlines
| Who | Tells whom | Deadline |
|---|---|---|
| Data controller | The Data Commissioner | Within 72 hours of becoming aware of the breach |
| Data processor | The data controller | Within 48 hours of becoming aware of the breach |
| Data controller | Affected data subjects | In writing within a reasonably practical period, unless their identity cannot be established |
Where the full facts are not known within 72 hours, notify with what you have and send the rest in phases. A late notification must say why it is late.
What the notification contains
- A description of the nature of the breach
- The categories and approximate number of data subjects and records affected
- The likely consequences for the people affected
- The measures taken or proposed to address the breach and limit the harm
- Recommendations to data subjects on how to protect themselves
- The contact details of your data protection officer or another contact point
Running the 72 hours well
The organisations that miss the deadline usually lose the first day finding out who decides. Agree in advance who records the awareness time, who assesses the risk, and who signs the notification, and keep a breach register so each step is time-stamped.
hlola's incident register starts a live clock from the awareness time you record, recommends whether to notify with the reasons, and raises a task for the regulator acknowledgement. The DPO's decision and rationale are stored as evidence, which is what an inspector reads first.
Common questions
How long do you have to report a data breach in Kenya?
A data controller must notify the Data Commissioner within 72 hours of becoming aware of a breach that creates a real risk of harm, under section 43 of the Data Protection Act, 2019.
Do processors have their own deadline?
Yes. A data processor must notify the data controller within 48 hours of becoming aware of the breach.
Do we have to tell the people affected?
Yes, unless their identity cannot be established. Notice must be in writing and give them enough information to take protective steps.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.