- Home
- Sectors
- Technology, Data and AI
- Data Protection Compliance
Flagship · Technology, Data and AI
Data Protection Compliance
Registration, impact assessments, data governance and breach readiness under the Data Protection Act, 2019 for public bodies, counties and regulated firms.
- Sector
- Technology, Data and AI
- Typical timeline
- 6 to 10 weeks for a compliance programme; 3 to 4 weeks for a single impact assessment
- Delivery
- Onsite or virtual
- Deliverables
- 6
The problem
The Data Protection Act, 2019 and its 2021 regulations are no longer new, and the Office of the Data Protection Commissioner has moved from awareness to enforcement. It issues determinations, enforcement notices, penalty notices and compensation orders, and registration certificates must be kept current. The courts have been equally direct: in May 2025 the High Court ordered the deletion of biometric data collected without an adequate impact assessment under section 31. Many institutions are registered on paper but cannot show a record of processing, a lawful basis for each purpose or a tested breach procedure.
Public bodies carry additional duties. Regulation 26 of the Data Protection (General) Regulations, 2021 requires processing for strategic state interests, including civil registration, public finance and health care, to run on servers in Kenya or keep a copy there, and health records also fall under the Digital Health Act, 2023. Counties hold revenue, health and social programme data and face the same obligations as any national agency.
Policy anchors
- Data Protection Act, 2019
- Data Protection (General) Regulations, 2021
- Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021
- Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021
- Digital Health Act, 2023
How we work
Gap assessment
We review registration status, policies, contracts and systems against the Act and the 2021 regulations, and interview process owners to establish how personal data actually flows.
Records and lawful basis
We build the record of processing activities, confirm a lawful basis for each purpose and identify sensitive, children's and biometric data that attract heightened duties.
Impact assessments
We prepare data protection impact assessments for high-risk processing in the format the regulations prescribe, ready for submission to the Data Commissioner where required.
Governance and contracts
We set data governance roles, including the data protection officer function, and review processor, data sharing and cross-border transfer arrangements with vendors and partners.
Breach readiness
We write the incident and breach response procedure, test it in a tabletop exercise and train the staff who must apply it.
- Compliance gap assessment with a prioritised remediation plan
- Record of processing activities and lawful basis register
- Data protection impact assessments for high-risk processing
- Data protection policy, privacy notices and data sharing templates
- Breach response procedure and tabletop exercise report
- Staff training sessions and materials
Ministries, state agencies, county governments, hospitals, universities, SACCOs and companies that process personal data at scale or for purposes that require mandatory registration.
Questions clients ask
Does every organisation have to register with the ODPC?
Data controllers and processors must register, with an exemption for small entities below set turnover and staff thresholds. The exemption does not apply to listed purposes such as financial services, telecommunications, CCTV and direct marketing. We confirm your position before advising on registration.
When is a data protection impact assessment required?
Section 31 of the Act requires one where processing is likely to result in a high risk to data subjects, and the General Regulations list examples including biometric data, large-scale processing and automated decisions with significant effects. The Worldcoin judgment of May 2025 shows that courts will stop processing where the assessment is missing or inadequate.
How does this apply to health data?
Health data is sensitive personal data under the Data Protection Act, 2019 and is also governed by the Digital Health Act, 2023 and its 2025 regulations. We align both regimes so that facilities and counties meet consent, retention and breach duties once, not twice.