Data Protection Act

This Act may be cited as the Data Protection Act.

States that a 'Section' is processed by equipment operating automatically in response to instructions given for that purpose.

The provision states the object and purpose of the Act is to regulate the processing of personal data.

Personal data may be entered in a record by or for a data controller or processor using automated or non-automated means; if processed non-automatedly the recorded personal data forms a whole or part of a filing system.

The Data Commissioner may delegate any power under this Act or other written law to a regulator established by an Act of Parliament, subject to conditions the Commissioner may impose.

Section 11 is titled "Vacancy in the Office of the Data Commissioner."

A person seeking removal of the Data Commissioner may present a complaint to the Public Service Commission setting out the alleged facts for the ground.

The Data Commissioner must, in consultation with the Public Service Commission, appoint the number of staff necessary to discharge the Office's functions under this Act or any other relevant law.

The Data Commissioner and the Office staff are to be paid remuneration or allowances; the Salaries and Remuneration Commission may advise on those amounts.

The Data Commissioner must take the oath set out in the First Schedule upon appointment.

The Data Commissioner and Office staff must not disclose information obtained for the purposes of this Act except with lawful authority.

The Data Commissioner and staff of the Office are protected from personal liability for performing their functions in good faith and in accordance with the Act.

Establishes the Office of the Data Protection Commissioner, its composition, powers to act legally and hold property, and duties including ensuring access and creating directorates.

When there is a vacancy for the Data Commissioner, the Public Service Commission must start recruitment; it must invite applications and shortlist, interview and nominate three candidates for the President to forward for appointment, and the President, with approval of the National Assembly, appoints the Data Commissioner.

Sets qualifications for the Data Commissioner (education and experience) and provides appointment term of six years with no re-appointment.

Sets out the functions of the Office of the Data Commissioner, including oversight, registration, inspections, investigations, promotion of self-regulation, public awareness, research, international cooperation, and other prescribed functions; allows collaboration with national security organs and requires the Data Commissioner to act independently.

The Data Commissioner may enter into association with other bodies or organisations within and outside Kenya to further the object of the Act.

No person may act as a data controller or data processor unless registered with the Data Commissioner.

Data controllers or processors required to register must apply to the Data Commissioner, provide specified registration details, notify changes, and may face offences for false information or failure to comply; the Data Commissioner must issue certificates and amend the Register on notification.

The holder of a registration certificate may apply to renew the certificate after it expires.

The Data Commissioner must keep a register of registered data controllers and data processors; the Commissioner may remove ceased entries on request; the register is a public document available for inspection by any person; a person may request a certified copy of any entry.

Cancellation or variation of the certificate where any information given by the applicant is false or misleading.

The Data Commissioner may carry out periodical audits of the processes and systems of data controllers and data processors to ensure compliance with the Act.

Specifies when and how data protection officers may be designated and lists DPO duties; controllers/processors must publish DPO contact details and inform the Data Commissioner, who must make them available on the official website.

Personal data must be processed in accordance with the right to privacy of the data subject.

Data subjects are entitled to be informed about the use to which their personal data will be put.

Where the data subject is a minor, the rights are to be exercised by a person who has parental authority or by a guardian.

Data controllers or processors must collect personal data directly from the data subject, and may only collect, store or use personal data for lawful, specific and explicitly defined purposes.

Duty to notify

Lists lawful bases for processing personal data and states that a data controller who contravenes subsection (1) commits an offence.

When processing is likely to create high risk to individuals, a data controller or processor must carry out a data protection impact assessment before processing; if that assessment shows high risk they must consult the Data Commissioner; assessment reports must be submitted sixty days before processing.

Data controllers or processors must prove a data subject's consent; data subjects may withdraw consent at any time.

Data controllers or processors must include age-verification and consent mechanisms to process personal data of a child; certain child-protection counselling providers may not need parental consent.

Data controllers must inform the data subject before withdrawing a restriction on processing; data controllers or data processors must implement mechanisms to ensure time limits for rectification, erasure, restriction or periodic review of stored personal data are observed.

Every data subject has a right not to be subject to a decision based solely on automated processing, including profiling, except where allowed for contract necessity, law authorisation with safeguards, or consent; controllers/processors must notify and either reconsider or make a new non-automated decision; the Cabinet Secretary may make Regulations to provide safeguards.

A data subject has a right to object to the processing of their personal data unless the controller or processor shows a compelling legitimate interest that overrides the data subject's interests, or when needed to establish, exercise or defend a legal claim.

Data controllers or processors using personal data commercially must, where possible, anonymise the data so the data subject is no longer identifiable; the Cabinet Secretary may, with the Data Commissioner, prescribe practice guidelines.

Gives data subjects rights to receive, transmit, and (where technically possible) have personal data transmitted directly between controllers/processors; controllers/processors must comply with portability requests at reasonable cost within thirty days; the Data Commissioner may determine technical capacity when direct transfer is declined; processing necessary for public interest or that adversely affects others may limit portability.

Data controllers and processors must delete, erase, anonymise or pseudonymise personal data that is not necessary to retain under subsection (1), in a manner that may be specified, at the expiry of the retention period.

Data controllers and data processors must promptly rectify inaccurate, out-dated, incomplete or misleading personal data and must erase or destroy personal data they are not authorised to retain; if the data is required for evidence they must restrict processing and inform the data subject within a reasonable time.

Requires implementing data protection principles and integrating necessary safeguards into processing, and lists factors and safeguards to consider (e.g. amount of data, extent of processing, storage period, accessibility, costs, pseudonymisation, encryption, and restoration ability).

Section 42 requires controllers to choose processors with sufficient organisational-security guarantees, requires controllers and processors to have a written contract specifying that processors act only on controller instructions and are bound by the controller's obligations, and requires controllers or processors to take reasonable steps to ensure staff and agents comply with security measures.

Requires prompt notification of personal data breaches to the Data Commissioner (within 72 hours) and, subject to conditions, written communication to affected data subjects; sets processor-to-controller timing (48 hours), required content elements, allowed phased disclosure, a limited exemption when adequate safeguards like encryption exist, and permitted delay for criminal investigation purposes.

Monies are allocated by the National Assembly for purposes of the Office.

The Data Commissioner must prepare annual estimates of the Office's revenue and expenditure at least three months before each financial year starts.

The Office must have its annual accounts prepared, audited and reported in accordance with Articles 226 and 229 of the Constitution, the Public Finance Management Act (Cap. 412A), or any other law relating to audit of public entities.

The Data Commissioner must prepare and submit an annual report to the Cabinet Secretary within three months after the end of each financial year; the Cabinet Secretary must submit that report to the National Assembly within three months of receipt.

Sensitive personal data must not be processed unless section 25 applies to that processing.

Permitted grounds: processing relates solely to the members of the body or to persons who have regular contact with it in connection with its purposes.

Section 46 lists grounds for processing personal data relating to health: by or under the responsibility of a health care provider; by a person subject to professional secrecy; when necessary for public health; or by another person who owes a duty of confidentiality.

The Data Commissioner may prescribe or specify additional categories of personal data as sensitive and may consider listed factors when doing so.

The data controller or data processor must give proof to the Data Commissioner of appropriate safeguards for security and protection of personal data before transfer out of Kenya.

Section 49 gives the Data Commissioner powers to request evidence about security safeguards for transfers and to prohibit, suspend or condition transfers to protect data subjects; transfer of sensitive personal data out of Kenya requires consent and confirmation of appropriate safeguards.

The Cabinet Secretary may prescribe that certain types of processing must be done only using a server or data centre located in Kenya.

Data controllers and data processors are not exempt from complying with data protection principles, except for personal/household processing, national security/public interest, or court- or law-required disclosures.

The Data Commissioner must prepare a code of practice giving practical guidance on processing personal data for journalism, literature and art.

Further processing of personal data for research, history or statistics must be compatible with the original purpose; data controllers/processors must ensure such processing is solely for those purposes and not published identifiably; they must take safeguards to prevent other uses; the Data Commissioner must prepare a code of practice.

The Data Commissioner may prescribe additional instances where compliance with certain provisions of the Act may be exempted.

The Commissioner must prepare a data-sharing code that provides practical guidance on sharing personal data and other guidance to promote good practice, and must specify lawful exchange of personal data between government departments or public sector agencies.

A data subject aggrieved by a decision may complain to the Data Commissioner; a person intending to complain shall do so orally or in writing; orally made complaints must be recorded in writing; the Data Commissioner may prescribe procedures for handling complaints.

The Data Commissioner may require production or access to material stored in mechanical or electronic devices; a person who, without reasonable excuse, fails to comply with a notice or gives the Commissioner information they know to be false or misleading commits an offence.

The Data Commissioner may serve an enforcement notice requiring a person to take specified steps within a period (not less than 21 days) and stating a right of appeal; failing without reasonable excuse is an offence punishable by a fine up to five million shillings or imprisonment up to two years, or both.

The Data Commissioner may seek assistance from persons or authorities to gather information or carry out investigations under the Act when reasonably necessary.

The Data Commissioner may, on a court warrant, enter and search any premises to discharge functions or exercise powers under the Act.

Obstruction or impediment of the Data Commissioner in the exercise of their powers is addressed.

If the Data Commissioner is satisfied that a person has failed as described in section 58, the Data Commissioner may issue a penalty notice requiring the person to pay an amount specified in the notice; the Commissioner must consider a list of factors when determining the amount.

The Data Commissioner may impose administrative fines up to five million shillings, or for an undertaking up to one per centum of its annual turnover of the preceding financial year, whichever is lower.

A person who is subject to an administrative action by the Data Commissioner may appeal to the High Court.

A person who suffers damage because of a contravention of this Act is entitled to compensation from the data controller or data processor; controllers/processors are liable for damage caused by processing unless they prove they are not responsible.

The Data Commissioner may apply to a court for a preservation order to preserve personal data, including traffic data, when there are reasonable grounds to believe the data is at risk of loss or modification.

The Cabinet Secretary may make regulations to give effect to the Act and may prescribe specified matters (listed in subsections) including requirements for controllers/processors, certification mechanisms, notices/registrations, information to data subjects, fees, safeguards, local data server processing, codes of practice, and other matters deemed fit.

Makes it an offence for data controllers, data processors, and other persons to unlawfully disclose or offer to sell personal data, with an exception for employees or agents acting within their mandate.

A person convicted of an offence under this Act for which no specific penalty is provided shall be liable to a fine not exceeding three million shillings or to imprisonment for up to ten years, or both.

Section 74 directs issuance of guidelines, certification standards and sector-specific guidance, and states that certification does not remove controllers' or processors' responsibility for compliance.