Data Protection Policy Sample Kenya

DATA PROTECTION POLICY

This Data Protection Policy (the "Policy") is established and adopted by [Company Name], a company duly incorporated and existing under the laws of [Jurisdiction, e.g., Kenya], with its registered office at [Company Address] (hereinafter referred to as the "Organisation" or "Controller"), effective as of [Effective Date].

WHEREAS, the Organisation processes Personal Data in the course of its operations; WHEREAS, the Constitution of Kenya, 2010, guarantees the right to privacy, which includes the right not to have information relating to their family or private affairs unnecessarily required or revealed, or the privacy of their communications infringed; WHEREAS, the Government of Kenya enacted the Data Protection Act, 2019 (the "Act"), to give effect to Article 31(c) and (d) of the Constitution, to regulate the processing of personal data, and to provide for the rights of data subjects and obligations of data controllers and processors; WHEREAS, this Policy sets forth the Organisation's commitments to data protection and outlines the principles, procedures, and responsibilities governing the collection, processing, storage, and transfer of Personal Data to ensure compliance with the Act and other applicable data protection laws and regulations.

---

1. Document Preamble & Recitals

This Policy sets out the framework for the Organisation's commitment to protect the privacy and personal data of its employees, customers, partners, and any other individuals whose data it processes (collectively, "Data Subjects"). By adhering to this Policy, the Organisation aims to foster trust, ensure legal compliance, and manage data responsibly. This Policy shall be reviewed annually or as necessitated by changes in law or operational practices.

2. Operational Definitions

For the purposes of this Policy, the following terms shall have the meanings ascribed to them below:

1. "Act" refers to the Data Protection Act, No. 24 of 2019, of Kenya, as amended from time to time, and any subsidiary legislation or regulations issued thereunder.
2. "Consent" means any unequivocal indication of a Data Subject’s wishes which, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to the Data Subject.
3. "Data Controller" means a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purpose and means of the processing of Personal Data. Within this Policy, the Organisation acts as the Data Controller for the data it collects and processes directly.
4. "Data Processor" means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Data Controller.
5. "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
6. "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
7. "Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
8. "Pseudonymisation" means the processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the Personal Data are not attributed to an identified or identifiable natural person.
9. "Recipient" means a natural or legal person, public authority, agency, or another body to whom the Personal Data are disclosed, whether a Third Party or not.
10. "Sensitive Personal Data" means data revealing an individual's race, health status, ethnic origin, conscience, belief, genetic data, biometric data, property details, marital status, family details, sex, or sexual orientation, political opinions, religious beliefs, or trade union membership.
11. "Third Party" means any natural or legal person, public authority, agency, or body other than the Data Subject, Data Controller, Data Processor, and persons who, under the direct authority of the Data Controller or Data Processor, are authorised to process Personal Data.
12. "Data Protection Officer (DPO)" means the individual designated by the Organisation to oversee data protection strategy and implementation to ensure compliance with the Act.
13. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

3. Substantive Terms & Obligations

3.1 Principles for Processing Personal Data

The Organisation shall adhere to the following principles when processing Personal Data:

1. Lawfulness, Fairness, and Transparency: Personal Data shall be processed lawfully, fairly, and in a transparent manner in relation to the Data Subject.
2. Purpose Limitation: Personal Data shall be collected for explicit, specified, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
3. Data Minimisation: Personal Data collected shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
4. Accuracy: Personal Data shall be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that Personal Data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
5. Storage Limitation: Personal Data shall be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the Personal Data are processed.
6. Integrity and Confidentiality (Security): Personal Data shall be processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures.
7. Accountability: The Organisation, as the Data Controller, shall be responsible for and be able to demonstrate compliance with the principles set out above.

3.2 Lawful Bases for Processing

The Organisation shall only process Personal Data if at least one of the following conditions is met:

1. The Data Subject has given Consent to the processing for one or more specific purposes.
2. Processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract.
3. Processing is necessary for compliance with a legal obligation to which the Organisation is subject.
4. Processing is necessary in order to protect the vital interests of the Data Subject or of another natural person.
5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Organisation.
6. Processing is necessary for the purposes of the legitimate interests pursued by the Organisation or by a Third Party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of Personal Data, in particular where the Data Subject is a child.

3.3 Rights of the Data Subject

Data Subjects have the following rights concerning their Personal Data, which the Organisation shall uphold:

1. Right to be Informed: The right to be informed of the use to which their Personal Data is to be put.
2. Right of Access: The right to request access to their Personal Data held by the Organisation.
3. Right to Object: The right to object to the processing of all or part of their Personal Data.
4. Right to Rectification: The right to demand that inaccurate or incomplete Personal Data be rectified or completed without undue delay.
5. Right to Erasure (Right to be Forgotten): The right to request the deletion or removal of their Personal Data where there is no compelling reason for its continued processing.
6. Right to Restriction of Processing: The right to restrict the processing of their Personal Data under certain conditions.
7. Right to Data Portability: The right to receive their Personal Data in a structured, commonly used, and machine-readable format and to transmit those data to another controller without hindrance.
8. Rights in Relation to Automated Decision Making and Profiling: The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, except under specific circumstances.

3.4 Obligations of the Data Controller (The Organisation)

1. Implementation of Technical and Organisational Measures: The Organisation shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, inter alia, as appropriate: the Pseudonymisation and encryption of Personal Data; the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services; the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident; and a process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
2. Data Protection by Design and Default: The Organisation shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as Pseudonymisation, which are designed to implement data protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to protect the rights of Data Subjects.
3. Records of Processing Activities: The Organisation shall maintain a record of all categories of processing activities under its responsibility.
4. Cooperation with the Data Commissioner: The Organisation shall cooperate, on request, with the Office of the Data Commissioner (ODPC) in the performance of its tasks.
5. Data Protection Impact Assessment (DPIA): Where a type of processing is likely to result in a high risk to the rights and freedoms of Data Subjects, the Organisation shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of Personal Data.
6. Prior Consultation: The Organisation shall consult the Data Commissioner prior to processing where a DPIA indicates that the processing would result in a high risk in the absence of measures by the Data Controller to mitigate the risk.
7. Designation of a Data Protection Officer (DPO): The Organisation [shall / has appointed] a DPO. The DPO's responsibilities include informing and advising the Organisation and its employees of their obligations under the Act, monitoring compliance, and acting as a contact point for the Data Commissioner and Data Subjects. The DPO can be reached at [DPO Contact Email/Phone].
8. Personal Data Breach Notification: In the event of a Personal Data Breach, the Organisation shall, without undue delay and, where feasible, not later than seventy-two (72) hours after having become aware of it, notify the Personal Data Breach to the Data Commissioner, unless the Personal Data Breach is unlikely to result in a risk to the rights and freedoms of natural persons. When the Personal Data Breach is likely to result in a high risk to the rights and freedoms of Data Subjects, the Organisation shall communicate the Personal Data Breach to the Data Subject without undue delay.

3.5 Obligations of Data Processors

Where the Organisation engages a Data Processor, the Organisation shall ensure that:

1. The processing by a Data Processor is governed by a contract or other legal act that sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of Personal Data and categories of Data Subjects, and the obligations and rights of the Data Controller.
2. The Data Processor processes Personal Data only on documented instructions from the Organisation.
3. The Data Processor ensures that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
4. The Data Processor takes all measures required for security of processing.
5. The Data Processor assists the Organisation in ensuring compliance with the Data Subject's rights.
6. The Data Processor assists the Organisation in ensuring compliance with security obligations and Personal Data Breach notifications.
7. The Data Processor, at the choice of the Organisation, deletes or returns all the Personal Data to the Organisation after the end of the provision of services relating to processing and deletes existing copies unless legal obligations require storage of the Personal Data.

3.6 International Transfers of Personal Data

Personal Data shall not be transferred outside Kenya unless:

1. The Data Subject has given Consent to the proposed transfer and has been informed of the possible risks of such transfers in the absence of adequate safeguards.
2. The transfer is necessary for the performance of a contract between the Data Subject and the Data Controller or the implementation of pre-contractual measures taken at the Data Subject's request.
3. The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the Data Subject between the Data Controller and another natural or legal person.
4. The transfer is necessary for important reasons of public interest.
5. The transfer is necessary for the establishment, exercise, or defence of legal claims.
6. The transfer is necessary to protect the vital interests of the Data Subject or of other persons, where the Data Subject is physically or legally incapable of giving Consent.
7. The Data Controller has provided appropriate safeguards and assurances regarding the protection of Personal Data, including legally binding corporate rules, standard contractual clauses approved by the Data Commissioner, or an approved code of conduct or certification mechanism.

3.7 Data Retention

The Organisation shall retain Personal Data for no longer than is necessary to fulfil the purposes for which it was collected or as required by applicable laws and regulations. The Organisation shall establish clear data retention schedules for different categories of Personal Data.

4. Default, Termination, and Remedies

4.1 Breach Classification

1. Material Breach: Any violation of a fundamental obligation under this Policy, including but not limited to, unauthorised disclosure of Sensitive Personal Data, failure to notify a Personal Data Breach as required, or repeated non-compliance with Data Subject rights.
2. Non-Material Breach: Any violation of a non-fundamental obligation under this Policy that does not significantly compromise the rights or freedoms of Data Subjects or the overall integrity of the data protection framework.

4.2 Notice and Cure

1. In the event of a breach of this Policy, the aggrieved party (e.g., Data Subject, Data Commissioner, or Organisation) shall provide written notice to the breaching party, specifying the nature of the breach.
2. For a Material Breach, the breaching party shall have [30] business days from receipt of the written notice to cure the breach to the reasonable satisfaction of the aggrieved party.
3. For a Non-Material Breach, the breaching party shall have [30] business days from receipt of the written notice to cure the breach. Repeated Non-Material Breaches may be considered a Material Breach.

4.3 Termination for Cause

1. Failure by the Organisation to cure a Material Breach within the stipulated [30] business days shall entitle the Data Commissioner, or where applicable, Data Subjects, to pursue remedies as provided by the Act and other applicable laws.
2. For any internal employee or contractor of the Organisation, failure to comply with this Policy may result in disciplinary action, up to and including termination of employment or contract, in accordance with the Organisation’s internal policies and applicable labour laws.

4.4 Consequences of Termination (Applicable to Data Processor Engagements)

Upon termination of any agreement for data processing services, the Data Processor shall, at the Organisation’s option, either return all Personal Data to the Organisation or securely delete all Personal Data, and certify in writing that it has done so, unless legal requirements mandate further storage.

4.5 Remedies

1. Legal Recourse: Nothing in this Policy shall preclude the Data Subject or Data Commissioner from seeking legal remedies, including but not limited to, injunctions, damages, or specific performance, in a court of competent jurisdiction or before the Data Commissioner, as provided for under the Act.
2. Indemnification: [The Organisation agrees to indemnify and hold harmless its employees and authorised agents from any claims, damages, or liabilities arising from the proper execution of their duties under this Policy, except in cases of gross negligence or willful misconduct.] [Conversely, any employee or third-party agent whose willful misconduct or gross negligence leads to a Personal Data Breach may be held liable for damages incurred by the Organisation or Data Subjects, subject to applicable employment/contractual terms and law.]

5. Boilerplate Legal Provisions

5.1 Severability

If any provision of this Policy is found by any court or administrative body of competent jurisdiction to be invalid, unenforceable, or illegal, the other provisions shall remain in full force and effect. If any provision would be valid, enforceable, or legal if some part of it were deleted, the provision shall apply with the minimum modification necessary to make it legal, valid, and enforceable.

5.2 Entire Agreement

This Policy constitutes the entire agreement and understanding between the Organisation and Data Subjects regarding the subject matter hereof and supersedes all prior discussions, agreements, and understandings of any kind (including without limitation any prior versions of this Policy) between them.

5.3 Force Majeure

Neither party shall be liable for any failure or delay in performing its obligations under this Policy where such failure or delay is caused by circumstances beyond its reasonable control, including, but not limited to, acts of God, war, riot, embargoes, acts of civil or military authorities, fire, floods, accidents, pandemics, or other unforeseen events.

5.4 Governing Law

This Policy and any disputes or claims arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of Kenya.

5.5 Dispute Resolution

1. Internal Resolution: Any grievances or disputes concerning this Policy by a Data Subject should first be directed to the Organisation's Data Protection Officer or designated contact person at [DPO Contact Email/Phone].
2. Mediation: If the dispute cannot be resolved internally within [30] days, the parties agree to attempt to resolve the dispute through mediation facilitated by a mutually agreed-upon mediator in [Nairobi, Kenya], before resorting to arbitration or litigation. The costs of mediation shall be shared equally between the parties.
3. Arbitration / Court: If mediation fails, any dispute, controversy, or claim arising out of or relating to this Policy, or the breach, termination, or invalidity thereof, shall be referred to and finally resolved by [arbitration in Nairobi, Kenya, in accordance with the UNCITRAL Arbitration Rules as at present in force OR the rules of the Chartered Institute of Arbitrators (Kenya Chapter)] OR [the competent courts of Kenya, specifically the High Court of Kenya at Nairobi].

---

6. Formal Execution Block

This Data Protection Policy is hereby adopted and issued by the Organisation. By signing below, the Organisation acknowledges its commitment to implement and enforce the provisions contained herein.

FOR AND ON BEHALF OF [ORGANISATION NAME]

[Signature]

Name: [Signatory Name] Title: [Signatory Title, e.g., Chief Executive Officer / Data Protection Officer] Date: [Date]

---

ACKNOWLEDGEMENT OF RECEIPT AND AGREEMENT TO ADHERE (Applicable for employees, contractors, or other individuals explicitly agreeing to the terms)

By signing below, I acknowledge that I have received, read, understood, and agree to adhere to the terms and conditions set forth in this Data Protection Policy. I understand my obligations concerning the protection of Personal Data as outlined herein.

FOR AND ON BEHALF OF [DATA SUBJECT / ACKNOWLEDGING PARTY NAME, e.g., EMPLOYEE NAME]

[Signature]

Name: [Signatory Name] Title: [Signatory Title, e.g., Employee / Contractor] Date: [Date]