If We Get Hacked, Is the Board Personally Liable?

The honest answer on data breach liability is: usually not directly, but the exceptions are exactly the situations most boards are not prepared for. Kenya’s Data Protection Act, 2019 is written primarily to hold the data controller, meaning the company, accountable. It does not make a director liable simply because the company is. That does not mean the board is insulated. It means the real exposure runs through a different, and in some ways broader, legal route.

What the Data Protection Act actually targets

If the Data Commissioner finds that a person has failed to comply, section 62 allows a penalty notice, and section 63 caps the administrative fine at KES 5 million or, in the case of an undertaking, one per cent of its annual turnover for the preceding financial year, whichever is lower. In an ordinary breach case that penalty is aimed at the controller or processor, which is the company, not at its directors personally.

The Act also creates offences. Section 72 covers a controller who discloses personal data in a manner incompatible with the purpose of collection, a processor who discloses data without the controller’s authority, a person who obtains access to personal data without authority or who discloses it to a third party, and a person who offers to sell personal data obtained in breach. Section 73 then sets a general penalty of a fine of up to KES 3 million, imprisonment of up to ten years, or both, for a person who commits an offence for which no specific penalty is provided or who otherwise contravenes the Act.

Those provisions can reach an individual, but they attach to what that individual did. A director who personally accessed or disclosed data without authority is exposed. A director of a company whose systems were compromised by an outside attacker is not exposed merely by holding office.

Where personal exposure to data breach liability actually comes from

The more realistic route to personal liability runs through the Companies Act, 2015. Every director owes a duty under section 143 to act in the way the director considers, in good faith, would promote the success of the company, and a duty under section 145 to exercise reasonable care, skill and diligence. A board that was warned about inadequate security, ignored a known vulnerability, or never asked basic questions about cyber risk has a real exposure under these general duties, separate from anything the Data Protection Act imposes.

That exposure is enforced by the company or, if the company does not act, by a member. Part XI of the Companies Act allows a derivative claim, brought by a member on the company’s behalf, for an actual or proposed act or omission involving negligence, default, breach of duty or breach of trust by a director. Section 194 also makes void any provision that purports to exempt a director from liability for negligence, default or breach of duty to the company, and restricts company indemnities for such liability, so a clause in the constitution cannot simply wish the risk away.

What actually protects a board

Being able to show that cyber risk was genuinely considered, rather than delegated silently to an IT team with no board visibility, separates a defensible board from an exposed one. In practice the board should be able to point to:

• a record of discussing the company’s cyber risk at a reasonable interval;
• a breach response plan that can meet the 72-hour notification deadline to the Data Commissioner under section 43;
• questions asked, and answers received, about what safeguards were actually in place before the incident, not only after it; and
• minutes that prove all of the above. Section 210 of the Companies Act requires minutes of directors’ meetings to be kept for at least seven years.

The practical takeaway on data breach liability

A breach itself is rarely what creates personal director liability. A board that never turned its mind to the risk beforehand, and cannot show that it did, is in a materially worse position than one that considered the risk, made reasonable decisions and was breached anyway. The distinction is entirely about what happened before the incident, not after.

If a breach does occur, the board’s conduct afterwards also matters. Minute who was told and when, what advice was taken, the decision whether to notify the Commissioner and the data subjects, and the reasons. Those records are the evidence of reasonable care if the decisions are later questioned.