A company leaked my data: do they have to tell me?
Data Protection Act, 2019 · sources read 4 Oct 2026
Yes, if there is a real risk of harm to you. The company must report the breach to the Data Commissioner within 72 hours and tell you in writing within a reasonably practical time, explaining what happened, what it is doing about it and what you can do to protect yourself.
- How long
- The Data Commissioner must investigate and finish a complaint within 90 days.
- Deadline
- The company must notify the Data Commissioner within 72 hours of becoming aware of the breach.
- Deadline
- A company processing data for another company must tell that company within 48 hours where reasonably practicable.
- Where
- First the company that held your data; then the Office of the Data Protection Commissioner (online at cie.odpc.go.ke)
Steps
- Read the notice and follow the steps it recommends to protect yourself (for example, changing a PIN or password).
- Ask questions through the data protection officer or contact person named in the notice.
- If you were not told, or the company mishandled your data, complain to the Data Commissioner, by speaking to them or in writing. It is free.
- If the breach caused you damage, the law entitles you to compensation from the company.
Watch out
- The company does not have to tell you if the leaked data was protected by proper safeguards such as encryption.
- The company may delay telling you if that is needed to prevent, detect or investigate a crime.
- If the company reports to the Data Commissioner after 72 hours, it must explain the delay.
Who this covers
- Anyone whose personal data was accessed or taken by someone without authority, where there is a real risk of harm to them.
Official sources (2)
- Data Protection Act, 2019 (No. 24 of 2019) new.kenyalaw.org · read 4 Oct 2026
- Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021 (L.N. 264 of 2021) odpc.go.ke · read 3 Oct 2026