The Data Protection Act 2019 comes into force today in Kenya, giving effect to the constitutional right to privacy and establishing a comprehensive data protection regime overseen by a new Office of the Data Protection Commissioner (ODPC).
Key points
- Controllers and processors above prescribed thresholds must register with the ODPC.
- Processing must follow familiar principles, including lawfulness, purpose limitation, data minimisation and security.
- Data protection impact assessments are required for high-risk processing.
- Personal data breaches must be notified to the Commissioner within 72 hours, and to affected individuals where there is a real risk of harm.
- Some processing, for example for certain public-interest purposes, may need to take place in Kenya.
The Act applies to controllers and processors established in Kenya or processing the personal data of people in Kenya. UK organisations with Kenyan operations, customers, staff or outsourcing partners should check whether they need to register and review their security, DPIA and incident response arrangements.
Source: Kenya Data Protection Act No. 24 of 2019 (Kenya Law)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
