KenyaData Protection Act, 2019, personal data breach notification
Data Protection Act, 2019 (No. 24 of 2019), s. 43 (notification and communication of breach)
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Notify the Data Commissioner within seventy-two hours of becoming aware of a personal data breach that carries a real risk of harm, giving reasons if you notify later.
- As a data processor, notify the data controller within forty-eight hours of becoming aware of a breach where reasonably practicable, and otherwise without delay (section 43(3)).
- Communicate the breach to the affected data subject in writing within a reasonably practical period, unless their identity cannot be established.
These lines are LexLint's reading of the law's text. Also read by: Office of the Data Protection Commissioner of Kenya (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.odpc.go.ke/wp-content/uploads/2026/07/ODPC-–-Guidance-Note-for-Data-Protection-Policies.pdf
- Guidance body
- Office of the Data Protection Commissioner of Kenya
- Open questions
- Is a breach outside the categories listed in regulation 37(1) of the Data Protection (General) Regulations, 2021 still one that carries a "real risk of harm" under section 43 of the Data Protection Act, 2019, given that the regulation says a breach "is taken to result in real risk of harm" if it relates to those categories?
What it makes you log
Logging duty
Section 43(8) makes the controller record, for each personal data breach, the facts relating to it, its effects and the remedial action taken. Those three items are not among the log content values, so the contents are left empty. The record is kept for every breach, whether or not it was notified under section 43(1). Section 43 says nothing about who may inspect the record or for how long it is kept, and sections that might (section 9(1)(e), section 57) are not cited by this row, so none is borrowed.
- Kind
- Explicit
- As of
- Provision
- Section 43(8)
- Trigger
- security_incident
What this law does
Where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm, a data controller must notify the Data Commissioner without delay, and in any event within seventy-two hours of becoming aware of the breach, giving reasons for any later notification.
A data processor that becomes aware of a breach must notify the data controller within forty-eight hours where reasonably practicable, and the controller must communicate the breach to the affected data subject in writing within a reasonably practical period unless their identity cannot be established.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .