Data breach notification in Kenya and South Africa

Kenya: section 43 of the Data Protection Act

Section 43 is headed notification and communication of breach ¹. The data controller must notify the Data Commissioner without delay, within seventy-two hours of becoming aware of the breach ¹. If the notice is not made within seventy-two hours, it must be accompanied by reasons for the delay ¹.

The controller must communicate with the data subject in writing within a reasonably practical period, subject to the exceptions in the section ¹. A data processor must notify the controller without delay and, where reasonably practicable, within forty-eight hours of becoming aware of the breach ¹.

Kenya: the ODPC reporting form

The ODPC says its mandate derives from the Data Protection Act 2019 and includes regulating the processing of personal data and protecting the privacy of individuals ⁵. Its website offers separate e-services to report a data breach, file a complaint and register as a data handler ⁵.

The Office of the Data Protection Commissioner runs an online form for controllers and processors reporting under section 43 ². Members of the public with a complaint are directed to a separate complaint route ².

• Whether the reporter is a controller or a processor ².
• A description of the breach and the categories of persons affected, such as customers, patients, employees or children ².
• The categories of data involved, including financial, identity, tax PIN, contact and health information ².
• Short-term and long-term remedial measures ².
• The date the breach occurred and the date it was discovered ².
• Whether the report came after 72 hours of discovery and, if so, why ².
• The primary cause, chosen from malicious or criminal attack, system fault, human error or other ².
• The number of data subjects, in bands from 1 to 10 upward, plus a best estimate ².

Kenya: penalties

The maximum amount the Data Commissioner can impose in a penalty notice is up to five million shillings or, for an undertaking, up to one per centum of annual turnover of the preceding financial year, whichever is lower ¹. The Act separately sets offences with a fine not exceeding five million shillings or imprisonment for a term not exceeding two years, or both ¹.

South Africa: section 22 of POPIA

Section 22 of POPIA is headed notification of security compromises ³. Where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by an unauthorised person, the responsible party must notify the Information Regulator and the data subject ³. An operator that processes information for a responsible party must notify that responsible party immediately in the same situation ³.

The notice to a data subject must be in writing ³. Section 22(4) lists the ways it can be sent ³.

• Mailed to the data subject's last known physical or postal address ³.
• Sent by e-mail to the last known e-mail address ³.
• Placed in a prominent position on the responsible party's website ³.
• Published in the news media ³.
• As directed by the Regulator ³.

South Africa: fines and the official text

An infringement notice from the Regulator must specify an administrative fine that may not exceed R10 million ³. The government publishes the Act as Protection of Personal Information Act 4 of 2013, with the stated aim of promoting the protection of personal information processed by public and private bodies ⁴.

Kenya and South Africa compared