Data protection basics for Kenyan businesses

If your business keeps names, phone numbers, ID details, health information or similar facts about customers, staff or members, the Data Protection Act, 2019 is likely to apply to you. The Act is supervised by the Office of the Data Protection Commissioner.

Habits that match the spirit of the Act

• Know what personal data you hold and where it lives. A simple list is a good start.
• Collect only what you need, and say why when you ask for it.
• Limit who can see it. Give each person access to what their job needs.
• Keep it secure: strong sign-in, encrypted laptops, updated systems and tested backups.
• Do not keep it for ever. Decide how long you need each kind of record.
• Have a plan for a breach: who decides, who is told and how fast.

What to check with your lawyer

• Whether you need to register with the Office of the Data Protection Commissioner.
• What your privacy notice must say.
• The rules for sending data outside Kenya.
• The duties and time limits that apply if there is a breach.

The technical side is where we can help: access control, encryption, logging, backups and recovery. The legal side belongs with your lawyer, and the two work best together.