The Data Protection (Civil Registration) Regulations

AI-assisted research summary: These Regulations may be cited as the Data Protection (Civil Registration) Regulations.

AI-assisted research summary: Mentions the National Registration Bureau.

AI-assisted research summary: Regulations cover registration of births.

AI-assisted research summary: Lawful processing of personal data.

AI-assisted research summary: Only authorized officers may access the data in its system.

AI-assisted research summary: Civil registration entities must obtain consent from data subjects when collecting personal data and must record that consent in physical or electronic form.

AI-assisted research summary: Consent may be given orally, in writing or by electronic means; consent must not be presumed from silence; consent is not implied where intention is ambiguous; data subjects must be informed of implications of giving, withholding or withdrawing consent.

AI-assisted research summary: Civil registration entities must ensure compatibility of new purposes for personal data, seek fresh consent if not compatible, and inform data subjects of implications (subject to section 32(2) and (3) of the Act).

AI-assisted research summary: Section 9 allows a data subject to request that a civil registration entity restrict processing of their personal data and requires the entity, if it declines, to notify the data subject within seven days with reasons.

AI-assisted research summary: A data subject must make a request in Form 2 (First Schedule) to access their personal data.

AI-assisted research summary: Gives data subjects the ability to request rectification of inaccurate, outdated, incomplete or misleading personal data held by a civil registration entity and sets form, documentation and content requirements; requires civil registration entities to rectify within thirty days if satisfied, to notify objections in writing, allows complaint to the Data Commissioner, and requires data subjects to notify changes.

AI-assisted research summary: A data subject who objects to processing under section 26(c) must apply to the civil registration entity using Form 1 in the First Schedule.

AI-assisted research summary: A civil registration entity must provide a data subject with their personal data in a structured, commonly used and machine-readable format within thirty days of receiving a written request, and after payment of required fees.

AI-assisted research summary: Authorized persons exercising a data subject's rights must consider the data subject's best interests; if there is doubt about the authorization, the civil registration entity must halt the request until evidence is provided; acceptable documents listed include a birth certificate, adoption certificate, court Order, or other relevant document.

AI-assisted research summary: Consent for processing a child’s personal data is given by the child’s parent or guardian.

AI-assisted research summary: Civil registration entities must ensure information given under section 29 is simple, clear and in an understandable language; they may use physical or electronic formats, verbal means or any other technology when giving that information.

AI-assisted research summary: Civil registration entities must retain processed personal data in perpetuity unless a specific processing reason means the data is not required forever, in which case the data must be deleted, anonymised or pseudonymised; entities must also create administrative mechanisms describing which categories of personal data are to be deleted, erased, anonymised or pseudonymised.

AI-assisted research summary: Civil registration entities must notify the Data Commissioner in writing and communicate to the data subject if personal data is breached; data subjects may notify the entity and Data Commissioner in writing within fourteen days of suspecting a breach.

AI-assisted research summary: If a DPIA may be required under section 31, a civil registration entity must carry out the DPIA using Form 1 in the Second Schedule; the resulting report must be published with the Data Commissioner’s approval in the manner the Data Commissioner decides.

AI-assisted research summary: The Data Protection Officer must monitor data system efficiency and keep written records of processing activities, including specified details such as transfers outside Kenya and security measures.

AI-assisted research summary: A civil registration entity may, subject to section 25 and upon request, make personal data it collected available to a public agency.

AI-assisted research summary: Section 22 sets requirements for automated individual decision making: inform the data subject; provide meaningful information about the logic; explain significance and envisaged consequences; prevent errors, bias and discrimination; use appropriate mathematical or statistical procedures; implement technical and organizational measures to correct inaccuracies and minimize risk of errors; secure personal data proportionate to risk and preventing discriminatory effects; and obtain human intervention, including obtaining human intervention and allowing the data subject to express their point of view.

AI-assisted research summary: Allows an aggrieved data subject to lodge a complaint with the civil registration entity; the entity must record oral complaints in writing, investigate and notify the data subject in writing within seven days after completion, and inform the data subject of the right to appeal to the Data Commissioner.

AI-assisted research summary: A civil registration entity must embed data privacy features into the database design to ensure protection of personal data.

AI-assisted research summary: Section technical safeguards for encryption of personal data at rest or in transit;

AI-assisted research summary: A civil registration entity must restrict unauthorized access, configure protections against distributed denial of service attack or user overload, and maintain continuous database backup to enhance database security.

AI-assisted research summary: The Data Commissioner may on a periodic basis conduct monitoring and evaluation of security safeguards employed by a civil registration entity.

AI-assisted research summary: Civil registration entities must have a written data security procedure and must assess annually whether it needs updating; entities controlling multiple databases may use a single procedure document.

AI-assisted research summary: Requires the civil registration entity to conduct data security risk assessments and to run access tests on database systems at least once every eighteen months, and to consider and amend any faults found; also requires securing the up-to-date database documents so only authorized users are provided access.

AI-assisted research summary: Civil registration entities must keep databases and database systems in secure places and must monitor and document entry to and exit from sites where those systems are located.

AI-assisted research summary: Civil registration entities must not grant database access or change authorization scope except where they have taken reasonable measures to screen and place authorized officers; they must train authorized officers before access or changes.

AI-assisted research summary: Civil registration entities must manage access permissions: determine authorized users' access per the authorized officer’s responsibilities, keep up-to-date records of roles and permissions, and immediately revoke access and change passwords when a user’s role ends.

AI-assisted research summary: Section 33 requires monitoring and documenting access attempts including user identity, date and time, system component, and access type/scope and whether access was granted or denied; it also states systems must not enable disabling or modifying their operation and must send alerts to an authorized officer or other relevant person if disabling or modifying occurs.

AI-assisted research summary: A civil registration entity must document cases where a data security incident was discovered that raises concerns about personal data integrity, unauthorized use, or deviation from authorization.

AI-assisted research summary: A civil registration entity must not connect the database systems to the internet or another public network unless appropriate safeguards against unauthorized access or harmful software are installed.

AI-assisted research summary: Civil registration entities must carry out an internal or external audit at least once every twenty-four months by a suitably trained auditor (not the entity’s data protection officer); auditors must report compliance, and entities must review reports and consider updating database or security procedure documents. Entities controlling multiple databases may perform a single audit for all databases.

AI-assisted research summary: The civil registration entity must retain backup copies of data and security procedures so integrity is preserved and data can be restored if lost or destroyed.

AI-assisted research summary: Civil registration entities must not transfer personal data collected for civil registration purposes out of Kenya unless they have written approval from the Data Commissioner.

AI-assisted research summary: A civil registration entity must submit an annual compliance report to the Data Commissioner.

AI-assisted research summary: Section 40 imposes requirements on civil registration entities and external service providers when outsourcing: the civil registration entity must assess data security risks before contracting and include required matters in contracts; external service providers must have authorized users sign confidentiality undertakings and must report at least quarterly and notify security incidents; civil registration entities must monitor compliance.