In today's digital economy, data protection is no longer optional: it is essential. We help organisations navigate Kenya's Data Protection Act with confidence, building robust compliance frameworks and managing risk.
Personal data is a legal responsibility
Almost every organisation today collects personal information: customer details, employee records, patient files, student data, photographs, mobile money records and CCTV footage. In Kenya the Data Protection Act, 2019 gives individuals rights over their personal data and places clear duties on those who collect and use it. The Office of the Data Protection Commissioner enforces the law and can investigate complaints, issue enforcement notices and impose administrative fines. Our data protection advocates help organisations of all sizes understand and meet these duties, and help individuals protect their rights.
Compliance is not only for large companies. Schools, clinics, SACCOs, small businesses, churches, employers and online sellers all handle personal data and may fall within the Act.
What the law requires
The Act sets out principles that organisations must follow. Personal data must be processed lawfully, fairly and transparently, collected for a specific purpose, kept accurate, held no longer than necessary and protected by appropriate security measures. Individuals have the right to be informed, to access their data, to correct it, to object to certain uses and to ask for deletion in suitable cases. Special care is needed with sensitive data, such as health information, and with data about children. The Act also regulates the transfer of personal data outside Kenya.
Most organisations that process personal data must register with the Office of the Data Protection Commissioner as a data controller or data processor, unless an exemption applies. We assess whether you must register and complete the process with you.
Building a compliance framework
We help organisations move from uncertainty to a clear, documented approach. We begin by understanding what data you hold, why you hold it, where it is stored and who can access it. We then prepare or review privacy notices, consent forms, data protection policies, retention schedules, contracts with service providers and procedures for responding to requests from individuals. Where the law requires it, we also advise on data protection impact assessments.
We train staff so that the policies work in practice, and we advise on appointing a person responsible for data protection. A well-run framework reduces the risk of complaints and fines and builds trust with customers and partners.
Breaches, complaints and regulatory action
If personal data is lost, stolen or disclosed by mistake, the law sets strict timelines for notifying the Data Commissioner and, in some cases, the affected individuals. We advise on how to respond quickly, limit the harm and meet your legal duties. If you receive a complaint or an enforcement notice, we represent you before the Commissioner and, where necessary, in an appeal to the High Court.
We also act for individuals whose data has been misused, helping them make complaints and seek remedies. If you need to comply with the Data Protection Act, have suffered a data breach or have received a notice from the regulator, get in touch with us for clear, practical advice.
Where to start
If you have never looked at data protection before, the best first step is a short review of what personal information you collect and how it is used. From that review we can tell you whether you need to register with the Data Commissioner, which documents are missing and what to fix first. Starting with the highest risks, such as health records, children's data, staff files and online forms, lets even a small organisation make steady progress without disruption to its work.
At a glance: what we handle
- Data Protection Act compliance frameworks
- Risk management
- Safeguarding personal information