The Data Protection Act 2019 grants Kenyans significant rights over how organisations collect, store, and use their personal data. Here is a plain-language guide.
The Data Protection Act, 2019 (DPA) is Kenya's landmark privacy legislation. It came into force on 25 November 2019 and is administered by the Office of the Data Protection Commissioner (ODPC).
Key Rights Under the DPA
1. Right to be Informed — You have the right to know when your personal data is being collected, what it will be used for, and who it may be shared with.
2. Right of Access — You can request a copy of any personal data an organisation holds about you.
3. Right to Rectification — If your data is inaccurate or incomplete, you have the right to have it corrected.
4. Right to Erasure — Also known as the 'right to be forgotten,' you can request deletion of your data in certain circumstances.
5. Right to Object — You can object to your data being processed for direct marketing or research purposes.
Penalties for Non-Compliance
Organisations that fail to comply with the DPA can face fines of up to KES 5 million or imprisonment of up to 10 years for serious offences.
How Veritas Legal Can Help
If you believe your data rights have been violated, our team can assist you in filing a complaint with the ODPC or pursuing civil remedies in court.
Disclaimer: This article provides general legal information only and does not constitute legal advice. For specific matters, consult a qualified advocate.