The First 24 Hours: A Crisis Communications Playbook for Kenyan Organisations
When a crisis breaks, the first day sets the tone for everything that follows. Here is how to use those hours well.
Read articleCommunications work runs on personal data: media lists, customer databases, event registrations, newsletter subscribers, website enquiries and social media audiences. Since Kenya's Data Protection Act came into force in 2019, how organisations collect and use that information is no longer just good practice — it is a legal responsibility overseen by the Office of the Data Protection Commissioner (ODPC).
This is not legal advice, and organisations should consult qualified counsel on their specific obligations. But there are practical principles every PR and marketing team should understand.
Collect only what you need — and say why
The Act requires personal data to be processed lawfully, fairly and transparently, for a specified purpose, and limited to what is necessary. For communications teams, that means asking whether every field on a form is genuinely needed, and clearly telling people how their information will be used. A short, plain-language privacy notice at the point of collection goes a long way.
Be careful with direct marketing
Sending promotional messages by SMS, email or messaging apps involves personal data. Make sure you have a proper basis for contacting people, keep records of how contacts were obtained, and always give recipients a simple way to opt out — then honour it promptly. Bought or scraped contact lists carry significant legal and reputational risk.
Respect people's rights
Individuals have rights over their data, including the right to be informed, to access the data held about them, and to ask for inaccurate data to be corrected or deleted. Communications teams should know who in the organisation handles these requests and how to route them quickly.
Secure your lists and tools
Spreadsheets of journalist contacts, event attendees or customers are often shared casually. Limit access, use secure tools, and remove data you no longer need. If a breach does occur, the Act sets out notification duties — including notifying the Data Commissioner without delay and generally within 72 hours of becoming aware of it — so communications and legal teams should already know how they would respond.
Privacy is also a reputation issue. A data incident handled poorly can do more lasting damage than the incident itself.
Build privacy into campaigns
When planning a campaign, event or website, consider data protection from the start rather than at the end. Ask what data will be collected, where it will be stored, who will access it, how long it will be kept and how people will be informed. Building these answers into the plan is far easier than fixing them later.
Trust is the point
For organisations in reputation-sensitive sectors, responsible data handling is part of the brand. Clear, honest communication about how you use people's information is one of the simplest ways to show that you deserve their trust.