A ransom note on the screen. Systems down. Phones ringing. What a business does in the first day of a cyber incident shapes its legal position for months afterwards, and panic is not a plan. This guide sets out the containment steps, the notification questions and the records that should exist before an incident happens.
Quick answer: isolate affected systems while preserving logs and evidence, activate the response team, establish whether personal data is involved, engage forensic specialists and keep one record of decisions and timings. Where a personal data breach is involved, the Data Protection Act 2019 requires notification to the Office of the Data Protection Commissioner. Suspected unauthorised access engages the Computer Misuse and Cybercrimes Act 2018, and contractual notification duties may also apply.
The first hours
Containment comes first, but it should not destroy the evidence. Affected systems should be isolated in a way that stops the spread while preserving logs and disk images for the investigation. The response team should be activated with clear roles for IT, management, communications and legal, and one person should be responsible for the incident log.
The team then needs to establish what is involved: which systems, which data, which customers or employees, and whether personal data has been accessed, lost or altered. Those answers determine the notification duties, so they should be recorded as they emerge rather than reconstructed later from memory.
Who must be told
Where a personal data breach is involved, the Data Protection Act 2019 requires notification to the Office of the Data Protection Commissioner without undue delay. The ODPC’s online breach notification form asks, among other things, whether the breach was reported more than 72 hours after discovery, and it invites a description of the breach, the categories of data and people affected, the remedial steps taken and whether affected individuals have been informed. Serious cases may require notification of the affected individuals as well.
Where unauthorised access to a computer system is suspected, the Computer Misuse and Cybercrimes Act 2018 is engaged, and a report to law enforcement may be appropriate. Banks, insurers, large customers and sector regulators may have their own notification requirements under contracts or regulatory rules. Those documents should be checked early in the response, because their deadlines may be shorter than the regulatory one.
Evidence and preservation
Evidence is the difference between a response that stands up and one that cannot be explained. Preserve logs, images of affected systems, email records, access records and the ransom note itself. Investigators should work from copies where possible, and the incident log should record who did what and when.
Wiping and rebuilding a system quickly may feel like recovery, but it destroys the record of how the intrusion happened. A short delay to take an image is usually worthwhile. Where legal advice is taken on the investigation, the business should consider how the investigation materials are labelled and stored, so that privilege questions can be addressed.
Making and documenting the notification decision
Notification is not an admission of fault; it is a duty in defined situations. The threshold question needs a reasoned answer, and the reasoning should be recorded at the time. That record is useful to the regulator, to insurers and to the board, and it protects the business if the facts later look worse than they did on day one.
Public communication should follow the facts. A statement made before the scope is understood can be difficult to correct, and speculation about the cause or the perpetrators is rarely useful. The response team should agree who speaks, on what basis and when, and the legal and communications workstreams should not operate in isolation.
Readiness before an incident
| Preparation | Why it matters in a live incident |
|---|---|
| Incident plan with named roles | Avoids deciding who is in charge during the crisis |
| Supplier cooperation clauses | Gets the technology provider to assist quickly |
| Tested backups | Allows recovery without paying for a decryption key |
| Data map | Shows which data and people are affected |
| Notification workflow | Keeps regulator and contractual duties on time |
| Insurance policy and contact | Brings in cover and specialists without delay |
Readiness is also a contract question. The agreements with technology providers, outsourcers, banks and large customers should require cooperation, define notification windows and address access to logs and systems. A service provider that cannot or will not assist during an incident turns a technical problem into a legal one.
After the incident
Once the immediate risk is controlled, the business should address root cause, remediation and any regulatory follow-up. That includes updating the impact assessment, correcting the security measures, retraining staff and recording the lessons in the incident plan. Where a customer or partner threatens a claim, the dispute resolution clause in the relevant contract usually determines the forum.
The post-incident file should be complete enough to answer a regulator, an insurer or a court. That means the incident log, the forensic report, the notification correspondence, the board minutes and the remediation plan, kept together and retained.
Cost, timing and when to get advice
Costs depend on the incident: forensic investigation, legal support, communications, recovery and any regulatory process. The timing is driven by the notification duties and by the investigation, which is why the first day matters so much. A business that has a plan and a contact list moves faster than one that starts by calling around.
Take advice immediately where personal data is involved, a ransom is demanded, the incident may affect customers or regulated services, a regulator has made contact, or litigation or a contractual claim is threatened. The firm’s ICT, data privacy and AI law practice in Nairobi advises on incident response and notification, and it works alongside the guides on data breach notification in Kenya and data protection impact assessments.
Primary sources
- Data Protection Act 2019, Kenya Law.
- Office of the Data Protection Commissioner: report a data breach.
- Computer Misuse and Cybercrimes Act 2018, Kenya Law.
This article is general information, not legal advice.
