An employee’s laptop is stolen from a parked car. It holds a spreadsheet of client names, phone numbers and identity document copies. A misdirected email sends a customer list to the wrong recipient. A server is left exposed by a configuration error. Each of these is a personal data breach, and each requires a decision within hours, not weeks. This article explains what a breach is, when notification is required and what a practical response looks like.
Quick answer
A personal data breach is any accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, personal data. Where a breach is likely to result in a risk to the rights and freedoms of individuals, the controller must notify the Office of the Data Protection Commissioner without undue delay, and must also tell affected individuals where the risk is high. The response should contain the incident, assess the risk, preserve evidence and record the decisions taken.
What counts as a personal data breach
The definition is wider than a hack. It covers confidentiality breaches, such as unauthorised disclosure or access; integrity breaches, such as alteration or corruption of data; and availability breaches, such as loss, theft or destruction of data. A lost phone, a misconfigured cloud bucket, a phishing incident that captured credentials, or a file sent to the wrong client can all qualify.
Whether notification is required depends on the risk the incident poses to the people whose data was involved, not on how the incident happened or whether the data was recovered. An incident involving a small number of records may still carry a high risk if the data is sensitive, such as financial, health or identity information.
The notification duty: the ODPC and affected individuals
The Data Protection Act 2019 places the notification duty on the data controller, which is the organisation that decides why and how the personal data is processed. Where the breach is likely to result in a risk to the rights and freedoms of data subjects, the controller must notify the ODPC without undue delay. The ODPC’s published guidance describes reporting within seventy-two hours of becoming aware of the breach, where feasible, and the Office provides a channel for reporting on its website.
Where the breach is likely to result in a high risk to individuals, the controller should also communicate with the affected people in clear and plain language, describing what happened, the likely consequences and the steps they can take to protect themselves. That communication should not wait for the outcome of a full investigation where the risk is serious.
Assessing the risk to individuals
The assessment should consider the type and sensitivity of the data, the volume of records, whether the data was encrypted or otherwise protected, whether the data has been recovered, who may have accessed it, and the likelihood of harm such as identity theft, financial loss, distress or discrimination. Record the assessment and its reasoning, even where the conclusion is that notification is not required.
The first hours: containment and escalation
- Contain the incident: suspend compromised accounts, revoke access, isolate affected systems and recover or wipe lost devices remotely where possible.
- Activate the response team and record who was informed and when.
- Preserve evidence before remediation overwrites logs, including system logs, emails and access records.
- Assess the data involved and the people affected, and decide whether the risk requires notification.
- Notify the ODPC and, where required, the affected individuals in plain language.
- Consider whether a criminal complaint is appropriate where unauthorised access or theft is suspected.
What a notification should contain
| Element | What to describe |
|---|---|
| Nature of the breach | What happened, when it was discovered and how it occurred |
| Data and people affected | The categories and approximate number of records and data subjects |
| Likely consequences | The risks to the individuals whose data was involved |
| Measures taken | Containment, remediation and steps to prevent recurrence |
| Contact point | The person responsible for responding to the regulator |
Processors, vendors and cloud services
Where a processor handles personal data on the controller’s behalf, the processor must notify the controller without undue delay after becoming aware of a breach. That obligation should be written into supplier contracts, with clear reporting channels, cooperation duties and timelines. Cloud and platform providers often sit between the controller and the incident, so the contract should say who notifies whom and how quickly.
The article on data controllers and data processors explains the allocation of roles. Vendor terms should also cover access controls, encryption, incident reporting and return or deletion of data at the end of the engagement.
Records, review and regulatory follow-up
Keep an internal record of every breach and near miss, including the assessment, the decision on notification and the reasons for it. A documented assessment is easier to defend if the regulator or an affected individual asks questions later. Review the incident after containment to fix the cause, update policies and train staff, and keep the evidence of those steps.
Where unauthorised access to a computer system is suspected, the Computer Misuse and Cybercrimes Act 2018 may also be engaged, and a police report can run alongside the data protection process. The article on cyber incident response in Kenya explains the technical and legal steps, and the firm’s ICT and data privacy practice advises on notification and response.
When to take advice
Advice is worth taking where the data is sensitive, where many individuals are affected, where the incident may involve unauthorised access, where the regulator has been contacted, or where notification wording will be public. Early advice also helps to keep the investigation and the legal assessment consistent.
Primary sources
- Office of the Data Protection Commissioner: report a data breach, for the current reporting channel and guidance.
- Data Protection Act 2019, Kenya Law, for the notification obligations of controllers and processors.
- Computer Misuse and Cybercrimes Act 2018, Kenya Law, for offences involving unauthorised access to computer systems.
This article is general information, not legal advice.
