Report a personal data breach to ODPC (organisations)
Office of the Data Protection Commissioner · sources read 2 Oct 2026
If personal data you hold is exposed and people could be harmed, report it on ODPC's breach form within 72 hours of finding out, then tell the affected people in writing. Processors must tell their controller within 48 hours.
- Fee
- We couldn't confirm a fee from the official page. Check it there before you pay.
- Deadline
- Notify ODPC within 72 hours of becoming aware of the breach
- Where
- Online on the ODPC website (odpc.go.ke/report-a-data-breach)
What you need
- Supporting documents, for example incident reports, your incident response policy and relevant agreements
- If you have told affected people: a sample of the message you sent
Steps
- Gather the facts: what happened, when it happened and was found, the cause, what data was exposed and how many people are affected.
- Within 72 hours of becoming aware, fill in the breach form at odpc.go.ke/report-a-data-breach.
- Describe the steps you have taken and plan to take, attach your documents and submit.
- Tell the affected people in writing within a reasonable time, including what happened and what they should do to protect themselves.
Watch out
- Missed the 72 hours? Still report it, and give the reasons for the delay.
- If you are a processor, tell the data controller without delay, within 48 hours where you can.
- You can ask ODPC to keep sensitive business details in the report confidential.
Who can apply
- Data controllers and data processors, or someone acting for them. Individuals with a data complaint use the ODPC complaint form instead.
Official sources (2)
- Report a Data Breach odpc.go.ke · read 2 Oct 2026
- The Data Protection Act, No. 24 of 2019 odpc.go.ke · read 2 Oct 2026