Data Protection in Kenya

Transfer in Kenya

Part VI of the Act

The transfer of personal data outside Kenya is highly regulated under the Act. Prior to any transfer the data controller or data processor must provide proof to the DPC on the appropriate safeguards with respect to the security and protection of the personal data including jurisdictions with similar data protection laws.

The consent of the data subject is required for the transfer of sensitive personal data out of Kenya.

Under the Regulations, civil registration registries cannot transfer personal data collected for civil registration purposes outside Kenya without the written approval of the DPC.

The General Regulations elaborate in more detail transfer of personal data outside Kenya. They provide for 4 legal bases for the transfer of personal data out of the country which include:

  1. appropriate data protection safeguards in the country or territory where recipient is based in;
  2. adequacy: an adequacy decision made by the DPC that the country, territory or the international organization where data is being transferred ensures an adequate level of protection of personal data;
  3. necessity: transfer is deemed to be necessary if it is:
    • for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject before entering into a contract;
    • for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another person;
    • for any matter of public interest;
    • for the establishment, exercise or defence of a legal claim in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent;
    • for the purpose of compelling legitimate interests pursued by the data controller or data processor which are not overridden by the interests, rights and freedoms of the data subjects.
  4. consent of the data subject on the condition they have consented to the proposed transfer and have been informed of the possible risks of transfer.
Back to top