Data Protection Compliance

Data protection compliance is the practice of ensuring that an organisation's collection, use, storage, and sharing of personal data complies with the Data Protection Act, 2019 and the regulations issued thereunder by the Office of the Data Protection Commissioner (ODPC). The Data Protection Act applies to every person or entity that processes personal data in Kenya, and to every person or entity that processes the personal data of individuals located in Kenya — regardless of where the processing takes place. Non-compliance can result in fines of up to KES 5,000,000 or 1% of annual turnover, whichever is lower, together with regulatory enforcement and reputational damage.

This area covers the full range of obligations under the Act. Advocates begin with a data protection audit — a comprehensive review of the organisation's data processing activities, its current policies and procedures, and its compliance with the Act. Advocates identify the personal data being processed, the purposes of the processing, the legal bases relied upon, the recipients of the data, the retention periods, and the security measures in place. Advocates prepare a gap analysis that identifies the areas of non-compliance and recommends a remediation plan.

Advocates assist with the registration of data controllers and data processors with the ODPC — which is mandatory for entities that meet the thresholds set by the ODPC. Advocates prepare the registration application, the prescribed fee, and the supporting documentation, and they manage the registration process through to the issuance of the certificate.

Advocates prepare the documentation required by the Act — including privacy policies (which inform data subjects about the processing of their personal data), data processing agreements (which govern the relationship between data controllers and data processors), data sharing agreements (which govern the sharing of personal data with third parties), and data retention policies (which specify how long personal data is retained and how it is disposed of). Advocates ensure that every document is tailored to the organisation's specific processing activities and that it complies with the transparency requirements of the Act.

Advocates conduct data protection impact assessments (DPIAs) for processing activities that are likely to result in a high risk to the rights and freedoms of data subjects — including the use of new technologies, large-scale processing of sensitive data, and the systematic monitoring of public areas. Advocates prepare the DPIA report, which identifies the risks, assesses their likelihood and severity, and recommends mitigation measures.

Advocates advise on the management of data subject rights — including the right to be informed, the right of access, the right to rectification, the right to erasure, the right to data portability, and the right to object to processing. Advocates prepare the procedures for receiving and responding to data subject requests, and they ensure that the organisation can respond within the statutory timeframes.

Advocates handle data breach management — advising on the notification obligations (which require the data controller to notify the ODPC and the affected data subjects within 72 hours of becoming aware of a breach), the investigation of breaches, and the remediation measures. Advocates also represent clients in investigations and enforcement proceedings before the ODPC, and they defend clients against data protection complaints and claims for compensation.