KenyaData Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- If a complaint is lodged against you, respond to the Data Commissioner within twenty-one days of the notice of the complaint, by making representations with supporting material or evidence, reviewing the complaint with a view to resolving it, or providing the information required.
- Comply with an enforcement notice from the date it is served on you; sending it to your last used email address, or posting or delivering it to your registered offices where you have no electronic address, is valid service.
- Pay the administrative fine imposed by a penalty notice within the payment period the notice specifies.
These lines are LexLint's reading of the law's text, as of .
What this law does
A respondent to a complaint must, within twenty-one days of the Data Commissioner's notice of the complaint, make representations and provide material or evidence in support, review the complaint with a view to resolving it to the complainant's satisfaction, or provide a response with the required information. Where a respondent takes none of those steps, the Data Commissioner proceeds to determine the complaint in accordance with the Act and the Regulations.
The Data Commissioner must communicate a determination to the parties in writing within seven days from the date of the determination. A decision of the Data Commissioner under the Regulations is binding on the parties and is enforced as an order of the Court. An enforcement notice takes effect from the date of service.
An enforcement notice is duly served when an electronic copy is sent to the concerned person's last used email address or, in the absence of an electronic address, when it is posted or physically delivered to that person's registered offices. A person may appeal to the High Court within thirty days of the date of service of the enforcement notice. A penalty notice may impose a daily fine of not more than ten thousand shillings for each breach identified until the breach is rectified.
The Data Commissioner enforces or takes action to recover a penalty once the period specified in the penalty notice for payment has lapsed, on the final determination of any appeal against the penalty notice, or on the lapse of the period given to appeal. The Regulations were published in the Kenya Gazette on and commenced that day.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.