Kenya
Consent
Consent must be informed, specific, and freely given, allowing individuals to withdraw it anytime.
Breach Notification
Notify the Office of the Data Protection Commissioner and affected individuals promptly in the event of a data breach.
Civil Registration Regulations
Process personal data in civil registries to align with data protection principles.
Local Processing
Certain data must be processed on servers located in Kenya, as per regulations.
Regulatory Authority
The Civil Registration Regulations, The Data Protection (General) Regulations, 2021, along with the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021, and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, have also since been gazetted. The Act establishes the Office of the Data Protection Commissioner to ensure enforcement.
Ms. Immaculate Kassait – Data Commissioner
Office of the Data Protection
Commissioner (ODPC)
The Office of the Data Protection Commissioner (ODPC) is the designated government agency that is key to ensuring appropriate handling of personal data in Kenya as enshrined in the Data Protection Act (DPA) of 2019.
