For many Kenyans, messaging companies on social media has become the quickest way to get help. But what happens when those official accounts are hacked and personal information, from phone numbers to financial details, falls into the wrong hands?
“Companies are required to implement appropriate technical and organisational safeguards, maintain data retention schedules, and ensure personal data is deleted or anonymised once the lawful purpose has expired. In the event of a breach involving social media DMs, companies must notify the Office of the Data Protection Commissioner (ODPC) within 72 hours,” says Catherine Kamau, Partner and Head of Data Privacy, Tech & Corporate Governance at Ashitiva Advocates LLP, Nairobi.
