Processes personal data, in Kenya

Computer Misuse and Cybercrimes Act (No. 5 of 2018), s. 40 · Read the law's page

• Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.
• Include in the report a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance that would delay or prevent telling them.
• This binds any person who operates a computer system or a computer network in Kenya, whether public or private; the duty is not limited to a critical-infrastructure operator, a licensed entity, or a business of any minimum size, and it binds a government body as well as a private one.
• Failing to make this report is itself an offence: a fine of up to two hundred thousand shillings, imprisonment of up to two years, or both; the Committee may separately propose isolating a suspected system pending resolution.
• This duty is in effect now and has applied since the Act commenced on 30 May 2018; the Computer Misuse and Cybercrimes (Amendment) Act, 2025 left this section unchanged.

Data Protection Act, 2019 (No. 24 of 2019), Part V (ss. 44-47) · Read the law's page

• Do not process biometric, genetic, health or other sensitive personal data unless a specific ground under section 45 applies, in addition to the Act's general lawful-basis requirement.
• Do not process health data unless you are a health-care provider or a person bound by professional secrecy.

Data Protection Act, 2019 (No. 24 of 2019), Part VI (ss. 48-54) · Read the law's page

• Give the Data Commissioner proof of appropriate safeguards, or otherwise satisfy a condition under section 48, before transferring personal data outside Kenya.
• Check whether the Cabinet Secretary has designated your category of processing for mandatory handling on a server or data centre located in Kenya.

Data Protection Act, 2019 (No. 24 of 2019), Part VIII (ss. 56-65, 72-74) · Read the law's page

• Expect the Office of the Data Protection Commissioner to investigate a data subject's complaint and to be able to issue a penalty notice for a contravention of the Act.
• Compensate a data subject who suffers damage from your contravention of the Act.

Data Protection Act, 2019 (No. 24 of 2019), s. 43 (notification and communication of breach) · Read the law's page

• Notify the Data Commissioner within seventy-two hours of becoming aware of a personal data breach that carries a real risk of harm, giving reasons if you notify later.
• As a data processor, notify the data controller within forty-eight hours of becoming aware of a breach where reasonably practicable, and otherwise without delay (section 43(3)).
• Communicate the breach to the affected data subject in writing within a reasonably practical period, unless their identity cannot be established.

Data Protection Act, 2019 (No. 24 of 2019), ss. 1-30 (establishment, principles and obligations) · Read the law's page

• Process personal data lawfully, fairly and transparently, only for an explicit and legitimate purpose, and collect no more than is necessary for that purpose.
• Register with the Office of the Data Protection Commissioner if your volume or category of processing meets the prescribed threshold.
• Obtain consent from a child's parent or guardian, verified through an age-verification mechanism, before processing that child's personal data.

Data Protection Act, 2019 (No. 24 of 2019), ss. 26, 33-34, 36-38 (rights of data subjects) · Read the law's page

• Respond to a data subject's request to access, correct or delete their personal data, and to a data portability request within thirty days.

Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021 (Legal Notice No. 264 of 2021), regs. 11, 14, 17, 19-21 · Read the law's page

• If a complaint is lodged against you, respond to the Data Commissioner within twenty-one days of the notice of the complaint, by making representations with supporting material or evidence, reviewing the complaint with a view to resolving it, or providing the information required.
• Comply with an enforcement notice from the date it is served on you; sending it to your last used email address, or posting or delivering it to your registered offices where you have no electronic address, is valid service.
• Pay the administrative fine imposed by a penalty notice within the payment period the notice specifies.

Data Protection (General) Regulations, 2021 (Legal Notice No. 263 of 2021), regs. 7, 10, 37, 49-50 · Read the law's page

• Conduct a data protection impact assessment before undertaking automated decision-making or profiling that has a legal or similarly significant effect on a data subject.

Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (Legal Notice No. 265 of 2021), regs. 4, 9, 11, 13, 15 and 18 · Read the law's page

• Register with the Data Commissioner as a data controller or a data processor, on the application form with a copy of your establishment documents and the registration fee, unless you are exempt under regulation 13(2) because your annual turnover or annual revenue is below five million shillings and you have less than ten employees.
• Register even where your annual turnover is below five million shillings if you process personal data for a purpose listed in the Third Schedule, such as gambling, health administration, the provision of financial services, telecommunications or direct marketing.
• Apply to renew your registration after your certificate of registration expires, which is twenty-four months from the date of issuance.
• Notify the Data Commissioner in writing within fourteen days of any change in your registered particulars.