Navigating Kenya’s Data Protection Act: What Organizations Need To Know

The Data Protection Act (DPA) is Kenya’s data privacy law that applies to the processing of personal data recorded by or for a data controller or processor, regardless of whether the means used are automated or non-automated.

Organizations must register with the Commissioner, identify lawful processing grounds, implement data protection principles, assess high-risk processing, safeguard data, report breaches (72 hours; 48 for processors), ensure lawful cross-border transfers, and follow strict rules for sensitive data.

Data subjects have the right to be informed, the right to access, the right to object, the right to rectification, the right to erasure, the right to data portability, and the right not to be subjected to automated decision-making.