Section 43 of the Act

As far as technical measures are concerned, the General Regulations require the use of hashing and cryptography to limit the possibility of repurposing personal data. They also require that the contract between a data controller and a data processor to include a clause on security measures subjecting the data processor to appropriate technical and organizational measures in relation to keeping personal data secure.

With respect to organizational measures, the General Regulations require a data controller or data processor to develop, publish and regularly update a policy reflecting their personal data handling practices. The policy may include:

1. the nature of personal data collected and held;
2. how a data subject may access their personal data and exercise their rights in respect to that personal data;
3. complaints handling mechanisms;
4. lawful purpose for processing personal data;
5. obligations or requirements where personal data is to be transferred outside the country, to third parties, or other data controllers or data processors located outside Kenya and where possible, specify such recipients;
6. the retention period and schedule; and
7. the collection of personal data from children, and the criteria to be applied.

The General Regulations provide for specific obligations to the data controller and data processor under the data protection principle of integrity, confidentiality and availability. These include:

1. having an operative means of managing policies and procedures for information security;
2. assessing the risks against the security of personal data and putting in place measures to counter identified risks;
3. processing that is robust to withstand changes, regulatory demands, incidents, and cyber-attacks;
4. ensuring only authorised personnel have access to the data necessary for their processing tasks;
5. securing transfers shall be secured against unauthorised access and changes;
6. securing data storage from use, unauthorised access and alterations;
7. keeping back-ups and logs to the extent necessary for information security;
8. using audit trails and event monitoring as a routine security control;
9. protecting sensitive personal data with adequate measures and, where possible, kept separate from the rest of the personal data;
10. having in place routines and procedures to detect, handle, report, and learn from data breaches; and
11. regularly reviewing and testing software to uncover vulnerabilities of the systems supporting the processing.

Mandatory Breach Notification

Yes. Please see above analysis under “Breach Notification”. The ODPC has also launched a portal where data breach notifications should be made.