Data Protection Act, 2019 🇰🇪

Kenya

Preface

Part I – PRELIMINARY

1. Short title

2. Interpretation

3. Object and purpose of this Act

4. Application

Part II – ESTABLISHMENT OF THE OFFICE OF DATA PROTECTION COMMISSIONER

5. Establishment of the Office

6. Appointment of the Data Commissioner

7. Qualifications of Data Commissioner

8. Functions of the Office

9. Powers of the Office

+8 more sections

Part III – REGISTRATION OF DATA CONTROLLERS AND DATA PROCESSORS

18. Registration of data controllers and data processors

19. Application for registration

20. Duration of the registration certificate

21. Register of data controllers and data processors

22. Cancellation or variation of the certificate

+2 more sections

Part IV – PRINCIPLES AND OBLIGATIONS OF PERSONAL DATA PROTECTION

25. Principles of data protection

26. Rights of a data subject

27. Exercise of rights of data subjects

28. Collection of personal data

29. Duty to notify

+14 more sections

Part V – GROUNDS FOR PROCESSING OF SENSITIVE PERSONAL DATA

44. Processing of sensitive personal data

45. Permitted grounds for processing sensitive personal data

46. Personal data relating to health

47. Further categories of sensitive personal data

Part VI – TRANSFER OF PERSONAL DATA OUTSIDE KENYA

48. Conditions for transfer out of Kenya

49. Safeguards prior to transfer of personal data out of Kenya

50. Processing through a data server or data centre in Kenya

Part VII – EXEMPTIONS

51. General exemptions

52. Journalism, literature and art

53. Research, history and statistics

54. Exemptions by the Data Commissioner

55. Data-sharing code

Part VIII – ENFORCEMENT PROVISIONS

56. Complaints to the Data Commissioner

57. Investigation of complaints

58. Enforcement notices

59. Power to seek assistance

60. Power of entry and search

+6 more sections

Part IX – FINANCIAL PROVISIONS

67. Funds of the Office

68. Annual estimates

69. Accounts and Audit

70. Annual reports

Part X – PROVISIONS ON DELEGATED POWERS

71. Regulations

Part XI – MISCELLANEOUS PROVISIONS

72. Offences of unlawful disclosure of personal data

73. General penalty

74. Codes, guidelines and certification

75. Consequential amendments

FIRST SCHEDULE

SECOND SCHEDULE

REPUBLIC OF KENYA

Data Protection Act, 2019

Act 24 of 2019

Assented to on 8 November 2019
Commenced on 25 November 2019
[This is the version of this document from 25 November 2019.]

AN ACT of Parliament to give effect to Article 31(c) and (d) of the Constitution; to establish the Office of the Data Protection Commissioner; to make provision for the regulation of the processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors; and for connected purposes

Part I – PRELIMINARY

1. Short title

This Act may be cited as the Data Protection Act, 2019.

2. Interpretation

In this Act, unless the context otherwise requires—"anonymisation" means the removal of personal identifiers from personal data so that the data subject is no longer identifiable;"biometric data" means personal data resulting from specific technical processing based on physical, physiological or behavioural characterisation including blood typing, fingerprinting, deoxyribonucle…

Read the Full Legislation on judy.legal

Access annotations, citing cases, and more legal research tools.

Open in judy.legal

Data Protection Act, 2019 🇰🇪

Table of Contents

REPUBLIC OF KENYA

Data Protection Act, 2019

Act 24 of 2019

Part I – PRELIMINARY

1. Short title

2. Interpretation

Read the Full Legislation on judy.legal