When a firm handling client data has a breach
What a Kenyan accounting firm must do when a breach hits client personal data: tell the client within 48 hours where practicable, and record the facts.
By Achekam · · 5 min read · For Accountants & audit firms in Kenya
It is a Friday afternoon. A payroll officer at the firm realises that last month's payslip pack for one client went to the wrong client's finance inbox. Or a laptop holding a folder of scanned ID copies is stolen from a car. Or a staff e-mail account is compromised and has been forwarding attachments for a week.
In each case, the personal data at risk belongs to someone else's employees or customers, and the firm was holding it because a client asked it to. Kenya's Data Protection Act gives the firm, as processor, a short and specific job: tell the client, fast. This article explains that duty, how it fits with the client's own deadline, what to record, and how a firm can use Achekam to answer the questions that follow.
The processor's duty
Section 43(3) of the Data Protection Act requires a data processor that becomes aware of a personal data breach to notify the data controller without delay and, where reasonably practicable, within forty-eight hours.
Two phrases do the work. "Without delay" is the main rule; the forty-eight hours is the outer limit where it is reasonably practicable to meet it, not a grace period. And the clock starts when the firm "becomes aware", which is why staff need to know that a misdirected e-mail is something to report internally the same day, not something to quietly fix.
Where the firm is processing for itself, such as its own staff records, it is the controller, and the controller's rules below apply to it directly.
Why the client needs it quickly
The client, as controller, has its own deadline. Under section 43, a controller must notify the Data Commissioner of a breach that poses a real risk of harm without delay, within seventy-two hours of becoming aware of it, and must give reasons if notification comes later. The controller must also tell affected data subjects in writing within a reasonably practical period, unless safeguards in place make that unnecessary.
The two clocks fit together. If the firm uses its full forty-eight hours, the client has very little time left to assess the risk and prepare a notice. A firm that tells the client within hours gives the client a real chance to meet its seventy-two. How the client handles its side is covered in notifying a data breach within 72 hours.
What to tell the client, and what to record
The controller has a record-keeping duty too. Section 43(8) requires a data controller to record the facts of every personal data breach, its effects and the remedial action taken. The client will need the firm's help to complete that record, so the firm's notice should give the client what it needs.
The ODPC's breach form is a good guide to what the client will be asked. The ODPC's form for reporting a personal data breach, used by controllers and processors to notify under section 43, asks what remedial action the organisation is taking, whether affected data subjects have been told, what steps individuals should take to reduce the risk of serious harm, and which other regulators have been notified. Supporting documents, such as an incident response policy, can be attached, and the ODPC says it will respect the confidence of commercially sensitive information.
So the firm's first notice to the client should cover, as far as is known:
- What happened and when the firm became aware of it.
- Which data and which people are affected, and roughly how many records.
- Who could have accessed the data, and whether it has been retrieved or deleted.
- What the firm has done already to contain it.
- What the firm recommends affected individuals do, if anything.
- Who at the firm is handling it, and when the next update will come.
It is better to send a first notice with gaps, marked as unknown, than to wait for a complete picture.
Evidence from Achekam
When a breach involves files held in Achekam, three features help the firm answer "who saw what" quickly.
Share links. Staff can share a vault document with a named person by an e-mailed link. The link can block downloading, require a code and be revoked, and every view and download is recorded. By default it lasts seven days, and the recipient needs no account. If a document went to the wrong person, the firm can revoke the link at once and see from the record whether it was opened or downloaded before that.
Access restrictions. Partners and administrators can restrict a client, or one engagement, to named people with a reason. The account manager and the engagement's partner and manager can always open it. A restriction is lifted rather than deleted, and who did what and when is recorded. After an internal incident, tightening access to the affected client is a quick containment step, and the record shows when it was done.
Record Governance. This log shows changes to governed records: who did what, when and with what result. It can be filtered and checked for an unbroken chain. It needs the AUDIT_LOG_VIEW permission and covers records under record governance, not every screen, so it is one source of evidence rather than the whole story.
None of these will tell the firm about an e-mail sent from outside Achekam or a stolen laptop. They help where the data was in Achekam, and the firm's notice should be honest about which parts of the picture they cover.
Write breach handling into the engagement terms
The forty-eight-hour duty works best when both sides have agreed in advance how it will run. The engagement letter, or a data processing schedule attached to it, can set out:
- the named contact at the client who receives breach notices, and a deputy;
- the channel to use, such as a phone call followed by e-mail;
- the information the first notice will contain;
- how the firm will support the client's notice to the Commissioner and to data subjects; and
- who bears the costs of investigation and notification.
Having those terms agreed means nobody is searching for a phone number on a Friday evening. The firm should also consider its own registration position; see ODPC registration and fees for accounting firms. Beneficial ownership registers are a special case with their own disclosure rules, covered in who may see beneficial ownership information.
Make the first hour easy
Write a one-page internal procedure: who staff tell, who decides whether a client must be notified, and the template for the first notice. Then run through it once with the team, using the misdirected payslip pack as the example.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
