Dentons HHM: Recent Developments on Data Privacy and Protection in Kenya

Dentons HHM: Recent Developments on Data Privacy and Protection in Kenya

By Dr. Daniel Wanjau (Partner, Dentons HHM), Joseph Macharia Kuguru (Associate, Dentons HHM) and Dean Wanjala (Associate, Dentons HHM)


Kenya's Data Protection Act (the "DPA") entered into force on 25 November 2019. 

The DPA gives effect to the provisions of Article 31 of Kenya's Constitution which provide for the fundamental right to privacy. The DPA is largely modelled on European Union's GDPR.

Recent Developments

Some of the recent developments in relation to the DPA and on issues relating to data protection in Kenya generally are:

  • The DPA establishes the Office of the Data Protection Commissioner (the "ODPC") headed by a Data Commissioner. The ODPC has been set up and the first Data Commissioner (Ms Immaculate Kassait) was appointed on 16 November 2020.
  • The ODPC has launched its official website- which aims to be a resource tool for provision of data protection information such as guidelines compliance requirements and rights of data subjects. Through the website, members of public will be able to report breaches, file complaints or report privacy concerns with the Data Commissioner. 
  • The DPA empowers the Data Commissioner to, inter alia, make regulations setting out thresholds for mandatory registrations by data controllers and data processors.
  • In January 2021, the Cabinet Secretary for Information, Communications, Technology, Innovation and Youth Affairs constituted the Taskforce on the Development of Data Protection General Regulations (the "Taskforce") to, inter alia, develop data protection regulations, conduct a comprehensive audit of the DPA, identify gaps in the law and propose amendments.
  • We anticipate that with the appointment of the Taskforce, the regulations setting out the thresholds for mandatory registration under the DPA are likely to be enacted soon.
  • The Data Commissioner has issued two Guidance Notes: (1) Guidance Note on Consent and (2) Guidance Note on Data Protection Impact Assessment. The Guidance Note on Consent provides guidance on the processing of personal data on the basis of consent whereas the Guidance Note on Data Protection Impact Assessment provides guidance to data controllers and data processors on when and how to conduct Data Protection Impact Assessments.
  • In addition, the Data Commissioner has prepared the following draft Guidelines that are awaiting comments and input from the public: Guidelines on Registration of Data Controllers and Processors; Certification of Data Controllers and Processors; Appointment of Data Protection Officers; and Data Sharing Code and Enforcement. We shall provide updates once these Guidelines are finalised and made public.

Way Forward

Given all these recent developments, it is recommended that data controllers and data processors take immediate steps to ensure compliance with the DPA including undertaking audits on how they process personal data, putting in place data privacy policies, data privacy notices, data transfer/sharing agreements and data storage policies and reviewing/inserting data protection clauses in standard form contracts.

For more information on this please contact Dentons Hamilton, Harrison & Mathews. This article was originally published as a Legal Alert by Dentons Hamilton, Harrison & Mathews on March 16, 2021, to view the original, follow this link:

Dr. Daniel Wanjau, PhD is a partner at Dentons Hamilton Harrison & Mathews. He is an advocate of the High Court of Kenya having been admitted to the bar 25 years ago. Daniel advises on and undertakes matters relating to corporate & commercial law, mergers and acquisitions, competition law, legal and regulatory compliance work, energy, oil & gas, capital markets, intellectual property and ICT. In addition, Daniel heads the firm's intellectual property practice. He advises a wide range of multinational and local clients on the management and prosecution of their IP portfolio in Kenya and in the East African region.

Dean Wanjala is an associate at Dentons Hamilton Harrison & Mathews in the corporate and commercial department. He specializes in advisory work, competition law, legal due diligence and compliance, data protection and privacy as well as mergers and acquisitions.

Joseph Macharia Kuguru is an associate at Dentons' Hamilton Harrison & Mathews. He currently practices at the Firm's Corporate, Commercial and Real Estate department in several practice areas including legal and regulatory compliance, data protection and privacy, business set-up, competition and wide range of general commercial and corporate, and Intellectual Property.

Related Stories

No stories found.
The Lawyer