Businesses routinely collect personal information through websites, customer registration forms, employment records, marketing campaigns and other activities.
Although this information can support legitimate business operations, organisations must consider the legal obligations that arise when they collect, use, store or share personal data.
Kenya’s Data Protection Act, 2019 provides the principal statutory framework for protecting personal data.
Collect only what you need
Businesses should consider whether the information they collect is necessary for a specified and legitimate purpose. Collecting excessive personal information without a proper justification can create unnecessary privacy and security risks.
Be transparent
Individuals should receive appropriate information about how their personal data will be used, in accordance with applicable legal requirements.
A business website should therefore have a privacy notice that accurately explains its data-handling practices, including relevant purposes, sharing arrangements and individual rights.
Protect the information you hold
Organisations should adopt appropriate technical and organisational safeguards to protect personal information against unauthorised access, loss, misuse or disclosure.
Measures may include access controls, secure storage, staff training, retention policies and procedures for responding to data incidents.
Respect individuals’ rights
The Data Protection Act provides rights to data subjects, subject to the applicable statutory conditions and exceptions. These include rights concerning access to personal data, correction of false or misleading data and, in relevant circumstances, deletion or objection to processing.
Businesses should establish appropriate procedures for handling requests and assessing whether they must comply.
Review your compliance obligations
Depending on the organisation and its activities, registration with the Office of the Data Protection Commissioner and additional compliance measures may be required. The applicable requirements should be assessed rather than assumed.
Privacy compliance is not simply a website checkbox. It involves how the organisation actually handles personal information throughout its operations.
Need help reviewing your business’s legal obligations?
Contact Asembo and Company Advocates for guidance on data protection, privacy-related risks and business compliance.
