In an era of rapid digital transformation, where a wide range of services are being made available to the public through digital platforms, the Office of the Data Protection Commissioner (ODPC) in Kenya has taken significant measures to ensure the protection of personal data.
Recognizing it as a constitutional right for all Kenyan citizens, the ODPC has been established to safeguard data subjects from any unauthorized or unlawful use of their personal information.
The establishment of the ODPC in November 2020 came after the enactment of the Data Protection Act of 2019, which outlines the legal framework for data protection in Kenya.
The office is entrusted with the responsibility of ensuring that the processing of personal data follows the principles stipulated in the Act.
Ms. Susan Waweru, Head of Legal Services at the ODPC, emphasized that the office is also focused on raising awareness among Data Controllers and Processors regarding their legal obligations.
Registering with the ODPC is the first step toward compliance with the Data Protection Act, helping organizations understand and adhere to the regulations.
Mr. Abdullahi Ali, an Advocacy Officer at the ODPC, mentioned the office’s efforts to create awareness throughout the country. He stated that various teams have been dispatched to different counties to educate data collectors and processors about the ODPC’s mandate, the provisions of the data protection Act, and their responsibilities in data protection. The goal is to reach every county by the end of the financial year.
During a sensitization exercise in Embu County, Ali urged data controllers and processors to be accountable for the information they hold and to ensure that it is used solely for its intended purpose.
He emphasized the importance of data minimization to mitigate risks such as fraud or unsolicited marketing by entities that might obtain personal data unlawfully. Data collectors and processors were advised to conduct a Data Protection Impact Assessment (DPIA) to identify potential risks and address them effectively, thereby preventing any data breaches.
Ali also emphasized the necessity for data collectors to establish a retention schedule, which specifies the appropriate length of time for holding information before it is lawfully discarded.
In cases where a data collector shares private data with another party for processing, a contract should be drawn up outlining the details of how this information will be managed.
Showing support for the ODPC’s mission, Ms. Mercy Gatobu, Deputy County Commissioner of Embu West, pledged her commitment to ensuring compliance with the Data Protection Act by all public and private entities in the county.
Noting that government departments often collect vast amounts of personal and sensitive data while providing services to the public, she stressed the urgency of protecting this information from unauthorized disclosure.
The Office of the Data Protection Commissioner in Kenya plays a crucial role in safeguarding personal data and upholding the constitutional rights of Kenyan citizens. Through its efforts to create awareness, educate data controllers and processors, and enforce the Data Protection Act, the ODPC is promoting a culture of data protection and accountability.
As Kenya’s digital landscape continues to evolve, the ODPC remains committed to ensuring that personal data is handled with the utmost care and security.
