The Data Protection (General) Regulations

AI-assisted research summary: The Regulations may be cited as the Data Protection (General) Regulations.

AI-assisted research summary: Defines the terms 'Act', 'Data Commissioner', and 'Office'.

AI-assisted research summary: Civil registration entities specified under the Data Protection (Civil Registration) Regulations (L.N. 196/2020) are exempt from these Regulations.

AI-assisted research summary: Allows a data subject to request rectification of personal data; requires controllers/processors to rectify within 14 days if necessary and to notify refusals in writing within 7 days.

AI-assisted research summary: Data subjects may request portability of their personal data; controllers/processors must port data within 30 days upon payment of prescribed fees and notify the data subject within seven days if they decline; fees must be reasonable and not exceed actual cost.

AI-assisted research summary: Gives data subjects the right to request erasure of personal data in specified circumstances, allows a data subject to request erasure in Form DPG5, requires controllers or processors to respond within fourteen days, and lists exceptions where the right does not apply.

AI-assisted research summary: When a person duly authorised by a data subject seeks to exercise rights on their behalf, the data controller or data processor must act in the data subject's best interests.

AI-assisted research summary: If a data subject withdraws consent to any part of processing, the data controller or data processor must restrict that part of the processing (subject to section 34 of the Act).

AI-assisted research summary: A data controller or data processor may process personal data without the data subject's consent when the processing is necessary for any reason set out in section 30(1)(b) of the Act.

AI-assisted research summary: Data controllers and processors must inform individuals when personal data is collected indirectly (within fourteen days), must ensure any new purpose for data is compatible with the original purpose, and must seek fresh consent where a new purpose is incompatible.

AI-assisted research summary: Sets when a data subject can request restriction of processing, how to make the request, duties on controllers/processors to implement and record a restriction and to notify third parties, allows controllers/processors to decline manifestly unfounded or excessive requests, requires written notification with reasons within 14 days when declining under section 34(2), and prohibits processing restricted data except for storage.

AI-assisted research summary: Data subjects may request that controllers or processors stop processing some or all of their personal data; controllers/processors must comply free of charge within fourteen days. The right is absolute for direct marketing, and objections for that purpose mean the data must not be processed for direct marketing.

AI-assisted research summary: Section 9 lets a data subject request access to their personal data (using Form DPG 2) and requires data controllers/processors to comply and provide access, copies or mechanisms to view data, with compliance within seven days.

AI-assisted research summary: A data controller or processor is treated as using personal data for commercial purposes when personal data is used to advance commercial or economic interests, for example to induce purchases or enable transactions.

AI-assisted research summary: Section 15 permits commercial use of personal data for direct marketing only in specified circumstances (collection from the data subject, notification that direct marketing is a purpose, consent, absence of an opt-out request) and requires controllers/processors to provide an opt-out mechanism; it prohibits transmission for direct marketing unless contact particulars for opting out are indicated and criminalises commercial use without consent with fines or imprisonment.

AI-assisted research summary: Section 16(1) lists required features of an opt‑out message (clear explanation, minimal effort process, direct accessible channel, free or nominal cost, accessible to persons with a disability). Section 16(2) prohibits a data controller or data processor from using or disclosing a data subject's personal data for direct marketing if the data subject has opted out and in accordance with the data subject's request.

AI-assisted research summary: Data controllers and data processors must include clear opt-out statements and mechanisms in direct marketing communications, and must provide an option to opt out of all future direct marketing; they may use preference-setting opt-out mechanisms.

AI-assisted research summary: Data subjects may ask controllers or processors to restrict disclosure or use of their personal data for direct marketing; controllers/processors must comply within seven days.

AI-assisted research summary: Data controllers and data processors must retain personal data only as long as reasonably necessary for the purpose and must establish time limits for periodic review of retained data for law enforcement purposes.

AI-assisted research summary: Data controllers or data processors may agree to requests to deal anonymously or pseudonymously if satisfied the request is for any reason listed in subsection (1) and it is in the data subject's best interests.

AI-assisted research summary: Data controllers and processors may share personal data on request (subject to section 25); controllers/processors must determine the purpose and means of sharing; routine sharing between controllers requires agreements; internal sharing within an organisation is not considered data sharing; sharing must specify purpose, retention duration and safeguards.

AI-assisted research summary: When processing involves automated individual decision-making, data subjects must be informed and provided protections including transparency about logic, fairness, error prevention, and the ability to obtain human intervention.

AI-assisted research summary: A data controller or data processor must develop, publish and regularly update a policy describing how they handle personal data and what that policy contains.

AI-assisted research summary: A data controller must engage a data processor through a written contract; data processors must obtain confidentiality commitments from third parties they allow to process personal data; the contract may include auditing and inspection provisions by the data controller.

AI-assisted research summary: Data processors must not engage third parties without prior authorisation from the data controller; if authorised they must contract with the third party, include required particulars, and remain liable for the third party's compliance.

AI-assisted research summary: Requires specified processing to be done in Kenya: process such personal data through a server and data centre located in Kenya; or store at least one serving copy of the concerned personal data in a data centre located in Kenya.

AI-assisted research summary: National security processing by specified organs counts as processing for national security; controllers/processors seeking exemption must apply to the Cabinet Secretary, who may issue or revoke exemption certificates.

AI-assisted research summary: Exemptions for public interest

AI-assisted research summary: Permitted general situation lessening or preventing a serious threat to the life, health or safety of any data subject, or to public health or safety

AI-assisted research summary: Section 57 lists permitted situations for collecting, using or disclosing health information and conditions under which disclosure is allowed.

AI-assisted research summary: Data protection mechanisms must be embedded in processing.

AI-assisted research summary: Requires elements for the protection of personal data by design or by default to implement the data protection principles in section 25.

AI-assisted research summary: Processing of personal data must have an appropriate legal basis or legitimate interests clearly connected to the specific purpose of processing.

AI-assisted research summary: Use clear, simple and plain language to communicate with a data subject so they can make decisions about processing their personal data.

AI-assisted research summary: Specify the purpose for each processing of personal data.

AI-assisted research summary: Requires having an operative means to manage policies and procedures for information security.

AI-assisted research summary: Encourage avoiding processing personal data altogether when possible for the relevant purpose.

AI-assisted research summary: Requires that data sources be reliable with respect to data accuracy.

AI-assisted research summary: Requires having clear internal procedures for deletion and destruction.

AI-assisted research summary: Data subjects are entitled to the highest degree of autonomy regarding control of their personal data.

AI-assisted research summary: Lists categories of personal data that, when breached, are treated as notifiable data breaches: (a) the data subject’s full name or identification number together with personal data/classes in the Second Schedule; (b) the data subject’s account identifier; and (b)(ii) any password, security code, access code, response to a security question, biometric data or other data used to allow access to the individual’s account. It also states what constitutes non-notifiable data (publicly available data or data disclosed as required/permitted by written law) and that a breach of the listed personal data amounts to a notifiable data breach under section 43 of the Act.

AI-assisted research summary: Section 38. Notification to Data Commissioner Section 38(1)(a) the date on which and the circumstances in which the data controller or data processor first became aware that the data breach had occurred; Section 38(1)(b) a chronological

AI-assisted research summary: Defines “data in transit” as personal data passing through Kenya en route to a foreign country or territory, not accessed, used or disclosed in Kenya except to effect the transportation.

AI-assisted research summary: Sets out general principles for transfers of personal data out of the country and requires appropriate data protection safeguards.

AI-assisted research summary: Transfers of personal data outside Kenya are allowed on the basis of appropriate safeguards, including where a data controller assesses the circumstances and concludes appropriate safeguards exist; transfers must be documented and documentation provided to the Commissioner on request, including date/time, recipient, justification and description of data transferred.

AI-assisted research summary: Deeming of appropriate safeguards Section ratified the African Union Convention on Cyber Security and Personal Data Protection

AI-assisted research summary: Binding corporate rules are legally binding, apply to and are enforced by every member of the group (including employees); they grant data subjects enforceable rights and must meet the requirements listed in subregulation (2).

AI-assisted research summary: Transfers of personal data are on the basis that the other country/territory/specified sector or the international organization ensures an adequate level of protection; the Data Commissioner may publish a list of such countries, territories, sectors and organisations on its website.

AI-assisted research summary: Personal data may be transferred to another country or territory if the transfer is necessary for purposes outlined under section 48(c); the transfer must be strictly necessary in a specific case and there must be no fundamental rights and freedoms that override the public interest; the section does not affect international agreements on judicial or police co-operation.

AI-assisted research summary: A data controller or processor must seek consent from a data subject before transferring sensitive personal data.

AI-assisted research summary: The entity effecting a permitted transfer must make the transfer conditional on no further transfer without authorization; a competent authority may authorize further transfers only where necessary for law enforcement.

AI-assisted research summary: The transferring entity is entitled to unlimited access to verify that the recipient has a robust information system for storing personal data.

AI-assisted research summary: Data processors and data controllers must conduct a data protection impact assessment before processing activities listed in subregulation (1).

AI-assisted research summary: Data controllers or processors may use the Third Schedule template to conduct a data protection impact assessment; the Data Commissioner may vary the assessment format by guidance notes despite subregulation (1).

AI-assisted research summary: When required, a data controller or processor must consult the Data Commissioner on the data protection impact assessment within sixty days of receiving the impact statement report.

AI-assisted research summary: Section 52 permits controllers and processors to consult the Office, allows the Data Commissioner to make recommendations, permits processing to start if no communication occurs within sixty days (and the report is deemed approved), and permits publication of the assessment report on a controller's or processor's website.

AI-assisted research summary: The Data Commissioner may carry out periodic audits to monitor compliance with the Assessment Report and recommendations.

AI-assisted research summary: A person aggrieved may lodge a complaint with the Data Commissioner about a decision by a data controller or data processor or about non-compliance.