Kenya's Data Protection Act, 2019 sets out how organisations must handle personal data, and the Office of the Data Protection Commissioner (ODPC) oversees compliance. Much of the work falls to IT: knowing where personal data lives, protecting it, and being able to respond when something goes wrong. This checklist is a starting point, not legal advice.
1. Know what you hold
- Keep an inventory of systems that process personal data, what data each holds, why, and who can access it.
- Identify sensitive personal data, such as health or biometric data, which needs extra protection.
- Record where data is stored, including cloud services and data held outside Kenya.
2. Check whether you must register
Data controllers and processors may need to register with the ODPC. Registration depends on factors such as the organisation's size and turnover and the type of processing, with some sectors required to register regardless. Confirm your position against the current regulations and ODPC guidance.
3. Build protection into systems
- Collect only the data you need, and set retention periods so data is deleted when no longer required.
- Encrypt data in transit and at rest, and restrict access by role.
- Log access to personal data and review the logs.
- Carry out a data protection impact assessment before introducing processing that is likely to be high-risk.
4. Prepare for breaches
The Act requires a data controller to notify the Data Protection Commissioner of a qualifying personal data breach within 72 hours of becoming aware of it, and in some cases to inform the people affected. Have a tested incident response plan that covers detection, assessment, containment, notification and lessons learned.
5. Support people's rights
Individuals can ask to access their data, have it corrected or deleted, object to processing and, in some cases, receive it in a portable format. Make sure your systems can find, export, correct and delete a person's data within the time limits.
6. Manage suppliers and transfers
- Put data processing terms in place with every supplier that handles personal data for you.
- Check the safeguards that apply before transferring personal data outside Kenya.
- Review supplier security, including where their data centres are and how they handle incidents.
