# What must a mental health service do after a data breach?

URL: https://tymirahealth.com/resources/faqs/what-must-a-mental-health-service-do-after-a-data-breach
For: Executives | Data protection and privacy | Reviewed by Independent clinical reviewer, Registered mental health clinician, Kenya | Last reviewed 8 November 2026

**Answer:** Under section 43 of the Data Protection Act, if personal data is accessed by an unauthorised person and there is a real risk of harm, the data controller must notify the Data Commissioner within 72 hours of becoming aware. If it notifies later, it must give reasons for the delay. Affected people must also be told. Processors such as software vendors must tell the controller within 48 hours where practicable. Have a written breach plan, record every incident, and get legal advice early.

Sources: Kenya Law: https://new.kenyalaw.org/akn/ke/act/2019/24/eng@2022-12-31 - Office of the Data Protection Commissioner: https://d4daccess.eu/sites/default/files/2024-02/ODPC-Guidance-Note-on-Processing-of-Health-Data.pdf - Kenya Law: https://new.kenyalaw.org/akn/ke/act/2019/24/eng%402022-12-31 - Office of the Data Protection Commissioner: https://www.odpc.go.ke/guidelines-2 - Kenya Law: https://new.kenyalaw.org/akn/ke/act/ln/2025/76/eng@2025-04-11

## Related questions

- [Can clinics in Kenya store patient data on cloud servers outside Kenya?](https://tymirahealth.com/resources/faqs/can-clinics-store-patient-data-outside-kenya)
- [Can employers screen staff for mental health conditions?](https://tymirahealth.com/resources/faqs/can-employers-screen-staff-for-mental-health-conditions)
- [Does a clinic need to register with the ODPC?](https://tymirahealth.com/resources/faqs/does-a-clinic-need-to-register-with-the-odpc)

---

**About Tymira Health:** Tymira Health is a healthcare technology company based in Nairobi, Kenya. It builds Tymira360, a practice management and EHR platform for mental health, physiotherapy and dental providers, clinics, hospitals, NGOs and insurers across Africa.

- Book a demo: https://tymirahealth.com/demo
- Contact: https://tymirahealth.com/contact (info@tymirahealth.com)
- All resources: https://tymirahealth.com/resources/all