Data Breach Response Policy
What happens, and how fast you hear from us, if something goes wrong.
Version 1.0 · Last updated 11 November 2026
What counts as a breach
A personal data breach is any security incident that leads to personal data being accessed, disclosed, altered, lost or destroyed without authority. Suspected breaches are treated as real until they are ruled out.
Notification deadlines
| Our role | Who we notify | When |
|---|---|---|
| Data Processor (data in your system) | You, the Data Controller | Without delay, and within 48 hours of becoming aware (s. 43(3)) |
| Data Controller (Helvino's own records) | The Data Commissioner | Within 72 hours of becoming aware, with reasons if later (s. 43(1) and (2)) |
| Data Controller (Helvino's own records) | Affected individuals | In writing, within a reasonably practical period, where there is a real risk of harm |
How we respond
- Detect and report: anyone who suspects an incident tells the Data Protection Officer immediately.
- Contain: we isolate affected systems, revoke exposed credentials and stop the loss.
- Assess: we establish what happened, what data and which people are affected, and the risk of harm.
- Notify: we notify as set out above.
- Recover: we restore secure service, from backups where needed.
- Learn: we identify the root cause, fix it, and update our controls.
What our notice to you will contain
As far as we know them at the time, and in phases where necessary:
- The nature of the breach.
- The measures taken or proposed to address it.
- Recommended steps to reduce its effects.
- Where applicable, the identity of the unauthorised person.
- The name and contact details of our contact point.
Your role as Data Controller
When a breach affects data in your system, the duty to notify the Data Commissioner and data subjects generally rests with you, and the 72-hour period applies to you. We will give you the information and help you need to meet it.
Records
We keep a register of every breach, recording the facts, its effects and the remedial action taken, whether or not it had to be reported.
Reporting an incident
If you believe personal data handled by Helvino has been compromised, email info@helvino.org with the subject "Data breach" or call +254 110 421 320.