Kenya’s Data Protection Act, 2019

Right to be Informed: Data subjects have the right to be informed about how their personal data is used. Organizations must also inform data subjects of their rights before collecting personal data.

Right to Access: Data subjects have the right to access their personal data held by the data controller or data processor. Regulation 9(4) of the Data Protection (General) Regulations, 2021, mandates that a data controller or data processor must comply with a request to access personal data within 7 days of the request.

Right to Rectification: Data subjects have the right to request correction of any false or misleading data. Under Regulation 10(4) of the Data Protection (General) Regulations, 2021, a data controller or data processor must rectify incorrect personal data within their database within 14 days of the request, provided the rectification is deemed necessary.

Right to Erasure: Data subjects have the right to request the deletion of false or misleading data. As per Regulation 12(3) of the Data Protection (General) Regulations, 2021, the data controller or data processor must respond to the data subject’s request for erasure within 14 days of receiving such a request.

Right to Data Portability: Data subjects have the right to receive personal data concerning them in a structured, commonly used, and machine-readable form. Where technically possible, the data subjects also have the right to have their personal data transmitted directly from one data controller or data processor to another. Regulation 11(3) of the Data Protection (General) Regulations, 2021 mandates that a data controller or data processor shall port data subjects’ personal data to their choice of recipient within 30 days of the request and payment of the prescribed fee.

Right to Object: Data subjects have the right to object to the processing of their personal data unless the data controller or data processor demonstrates compelling legitimate interests that override the data subjects’ interests or for the establishment, exercise, or defense of a legal claim. ata controller or data processor must comply with the data subject’s request for objection within 14 days of receiving such request.

Right Not to be Subjected to Automated Decision-Making: Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects the data subjects.