KenyaData Protection (General) Regulations, 2021
Data Protection (General) Regulations, 2021 (Legal Notice No. 263 of 2021), regs. 7, 10, 37, 49-50
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- continuous
- Who audits it
- Self
What it requires
- Conduct a data protection impact assessment before undertaking automated decision-making or profiling that has a legal or similarly significant effect on a data subject.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What volume or reach makes processing "large scale" under regulation 49(1)(g) of the Data Protection (General) Regulations, 2021, which lists "large scale processing of personal data" as a high-risk operation requiring a data protection impact assessment but sets no figure for it?
What it makes you log
Logging duty
Regulation 7(3)(b) makes the controller or processor mark on its own system that the processing of a data subject's personal data has been restricted, and regulation 49(2) makes it conduct a data protection impact assessment before the high-risk processing listed in regulation 49(1). Neither regulation names a log, so the duty rests on what the controller must be able to show: the restriction flag and the completed assessment. Regulation 53 (periodic audits to monitor compliance with an assessment report) is not among the regulations this row cites.
- Kind
- Implicit
- As of
- Provision
- Regulations 7(3)(b) and 49(2)
- Trigger
- personal_data_processing
What this law does
The Data Protection (General) Regulations, 2021 elaborate the Act's breach-notification duty and add operational detail on data-subject requests, including a fourteen-day deadline to notify a data subject in writing of a refused restriction request and a seven-day deadline for a refused rectification request.
Regulation 49 requires a data protection impact assessment before processing that includes automated decision-making or profiling with a legal or similarly significant effect, among other high-risk processing operations.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .