Data Protection Enforcement in Kenya: What Boards Should Expect

The Office of the Data Protection Commissioner has moved decisively from an educative posture to active enforcement. Determinations issued over the past cycle indicate a settled approach to consent, lawful basis, and the handling of complaints from data subjects.

Three obligations account for the majority of adverse findings: the absence of a documented lawful basis for processing, inadequate response to data subject requests, and the deployment of direct marketing without demonstrable consent.

Boards should require management to produce, at minimum, a current record of processing activities, a data protection impact assessment for high-risk processing, and evidence of an operative breach response procedure.

This publication is provided for general information and does not constitute legal advice. (Sample content.)