Crucial Steps to Protect Your Business from Cyber Threats featuring BrianLee Maingi

The Rising Cost of Cyber Incidents for Kenyan Businesses

The direct cost of a cyber incident, forensic investigation, system restoration, and business interruption, is frequently smaller than the downstream legal cost: regulatory notification obligations, potential enforcement action by the Office of the Data Protection Commissioner (ODPC), contractual liability to business customers whose data was exposed, and reputational damage that outlasts the technical remediation.

Data Protection Act Obligations You Cannot Ignore

Any organisation that determines the purpose and means of processing personal data qualifies as a data controller, or a data processor if it processes on another's behalf, and both categories carry registration and compliance obligations to the ODPC. Where a breach is likely to result in risk to the rights of the data subjects concerned, the Act requires notification to the Commissioner without unreasonable delay, and in certain circumstances, notification to the affected individuals themselves.

Businesses transferring personal data outside Kenya, common for companies using cloud infrastructure or regional shared services, must additionally satisfy the Act's cross-border transfer conditions, which is an area we see frequently overlooked until a transaction or an audit brings it to light.

Practical Safeguards We Recommend to Clients

Beyond the technical controls that IT teams already prioritise, we advise clients to maintain a documented incident response plan naming specific decision-makers and legal counsel in advance, to run a data mapping exercise identifying exactly what personal data is held and why, to put data processing agreements in place with every third-party vendor that touches customer or employee data, and to rehearse the notification timeline before an incident, not during one.