KenyaData Protection Act, 2019, rights of data subjects
Data Protection Act, 2019 (No. 24 of 2019), ss. 26, 33-34, 36-38 (rights of data subjects)
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Respond to a data subject's request to access, correct or delete their personal data, and to a data portability request within thirty days.
These lines are LexLint's reading of the law's text. Also read by: Office of the Data Protection Commissioner of Kenya (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.odpc.go.ke/wp-content/uploads/2026/07/ODPC-–-Guidance-Note-for-Data-Protection-Policies.pdf
- Guidance body
- Office of the Data Protection Commissioner of Kenya
- Open questions
- For how long may a controller extend the thirty days for a data portability request that is "complex or numerous", when section 38(7) of the Data Protection Act, 2019 leaves the extension to "a further period as may be determined in consultation with the Data Commissioner"?
What it makes you log
Logging duty
Sections 26, 33, 34 and 36 to 38 give data subjects rights and set the controller's response. Section 33(2) asks for mechanisms for age verification and consent and section 34(3) for mechanisms that keep time limits, but neither names a log or a record. Section 32(1), which puts the burden of proving consent on the controller, is not among the sections this row cites.
- Kind
- None
- As of
What this law does
Every data subject has a right to be informed of the use of their personal data, to access it, to object to its processing, and to correction or deletion of false or misleading data. A data subject also has a right to data portability in a structured, commonly used and machine-readable format, and a controller must comply with a portability request within thirty days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .