Your Company Just Had a Data Breach. What Do You Actually Do in the First 72 Hours?

Section 43 of the Data Protection Act, 2019 gives a data controller 72 hours from becoming aware of a breach to notify the Data Commissioner, where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the data subject. Most companies spend that window in confused escalation rather than a defined sequence of steps. Here is what a data breach response in the first 72 hours needs to look like, and where the Act leaves you less room than people assume.

The clock starts when you become aware, not when you are certain

Section 43(1)(a) runs the 72 hours from the moment the controller becomes aware of the breach, not from the point where an investigation has confirmed every detail. Waiting for certainty before starting the clock is not a safe reading of the Act. Section 43(2) does allow late notification, but only if it is accompanied by reasons for the delay, so a missed deadline has to be explained in writing to the regulator.

The duty sits on the controller. A processor that becomes aware of a breach must, under section 43(3), notify the controller without delay and, where reasonably practicable, within 48 hours. That qualifier matters: the 48 hours is a practical target for the processor, while the controller’s 72 hours is a fixed statutory period. If your vendor takes the full 48 hours to tell you, you may have only 24 hours left. Check that every processor contract requires prompt notice and gives you audit and cooperation rights before an incident, not after.

Hours 1 to 6: contain and record

Stop the ongoing exposure first. Revoke compromised credentials, isolate affected systems and close the gap that allowed access. In parallel, start a written, chronological log of what is known and when it was learned. This is not optional paperwork. Section 43(8) requires the controller to record the facts relating to the breach, its effects and the remedial action taken, and a log started late has to be reconstructed from memory.

Appoint one incident lead, involve your data protection officer if you have one, and instruct counsel early so that the factual investigation can be run under privilege where that is appropriate. Preserve logs and images of affected systems before they are overwritten by routine rotation.

Hours 6 to 24: decide whether the breach is notifiable

Not every security event is a notifiable breach. The statutory trigger is unauthorised access to or acquisition of personal data with a real risk of harm to the data subject. An outage, or an attack that was repelled without data leaving your systems, does not meet it. Work out, as best you can this early, which categories of personal data were involved, how many people are affected and what harm could follow. Sensitive data such as health records, financial information or children’s data pushes the assessment towards notification.

Document the reasoning either way. If you decide a breach is not notifiable, the written assessment is what you will rely on if the Commissioner later asks why no notice was given.

Before hour 72: notify the Commissioner with the right content

Section 43(5) lists what the notification must contain: a description of the nature of the breach, the measures the controller intends to take or has taken, recommendations on what the data subject can do to mitigate the harm, where applicable the identity of the unauthorised person, and the name and contact details of the data protection officer or another contact point. You do not need all of this on day three. Section 43(7) allows the information to be provided in phases without undue delay where it cannot all be given at once, which supports a short initial notice followed by a fuller report once the investigation matures.

Data breach response: telling the affected individuals

Communication to data subjects is a separate decision under section 43(1)(b). It must be in writing and within a reasonably practical period, unless the data subjects cannot be identified. The Act gives two relief valves. Under section 43(6), communication is not required where appropriate security safeguards such as encryption were applied to the affected data. Under section 43(4), the controller may delay or restrict communication as necessary and proportionate for the prevention, detection or investigation of an offence by the relevant body. Neither is a reason to say nothing without a documented basis.

The notice should be written so that a non-specialist can act on it: what happened, what data was involved, what they should do now, and who to contact. A vague notice that a customer cannot act on fails the purpose of section 43(5).

Why the first 72 hours matter beyond the deadline

Under section 63, the Commissioner can issue a penalty notice of up to KES 5,000,000 or, for an undertaking, up to one per cent of its annual turnover of the preceding financial year, whichever is lower. Under section 65, a person who suffers damage from a contravention of the Act is entitled to compensation from the controller or processor. A company that can show a disciplined, documented response is in a materially better position with the regulator and in any later claim than one that can only show confusion followed by a late, thin notification.