Module II: Legal Aspects of Data Protection
Module Overview
This module gives a thorough grasp of Kenya's legislative framework for data protection. It
discusses the legal basis of data protection, the provisions of the Data Protection Act (DPA) No.
24 of 2019, and the associated regulations. It also investigates guidelines provided by the
Office of the Data Protection Commissioner (ODPC) for various industries and thematic topics.
The session delves into the duties and responsibilities of data controllers and processors, as
well as the ODPC's enforcement authority. Furthermore, the curriculum investigates the many
data protection stakeholders, their interactions and finally the legal justifications for data
processing. The goal is to provide participants with the know-how to navigate data protection
and emerge competent and pragmatic in their application of privacy by default and design,
ensuring compliance in professional contexts.
Part I: the legal foundations for data protection.
This module establishes the fundamentals of data protection, concentrating on:
The legal foundation rooted in Constitutional right of privacy from Independence to the
current constitution;
the existing Legal framework;
the enactment of the Data Protection Act no. 24 of 2019; and
some of the important cases that have had an impact in Kenya’s data protection.
Part II: the scope of the Kenya Data Protection Act and its regulations
The module has focused on the main pieces of legislation; the Kenya Data Protection Act of
2019 and the regulations established by the Office of the Data Protection Commissioner
(ODPC) by concentrating on:
Page 1 of 4
1. The territorial application of Data Protection Act(Jurisdiction);
2. definitions of terms;
3. registration of data controllers and processors under the Act;
4. data protection principles;
5. permissible ways in which personal data is collected;
6. how protection impact assessment is undertaken;
7. automated decision making;
8. international data transfers and some important cases to consider;
9. exemptions to the provisions of the Data Protection Act;
10. enforcement authority granted to the Office Data Protection Commissioner; and
11. the regulations that the Office of the Data Protection Commissioner has developed and
published.
Part III: the Guidelines issued by the Office of the Data Protection
Commissioner (ODPC) for different sectors and subject matters
This module will review all the Guidance Notes and reports the Office of The Data Protection
Commissioner has so far developed and published to assist organizations in material
compliance.
Part IV: data protection stakeholders and their relationships
The module will focus on the various key stakeholders in the data protection ecosystem and
how they relate to each other. The focus will be on:
1. The data subject;
2. the data controller and processor relationship and their responsibilities to each other;
3. the data protection officer and their duties;
4. in depth look at the Office of the Data Protection Commissioner; and
5. the overall stakeholder relationship.
Page 2 of 4
Part V: the legal bases for data processing.
This module will interrogate the legal justifications for data processing personal data which
include:
1. Consent;
2. contractual obligation;
3. compliance with any legal obligation;
4. ital interests;
5. public interest;
6. legitimate interests; and
7. Historical, statistical, journalistic, literature and art or scientific research.
Assessment
This module will interrogate the legal justifications for data processing personal data which
include:
1. Consent;
2. contractual obligation;
3. compliance with any legal obligation;
4. ital interests;
5. public interest;
6. legitimate interests; and
7. Historical, statistical, journalistic, literature and art or scientific research.
Essential Reading
1. The Constitution of Kenya, 2010
2. The Data Protection Act, No. 24 of 2019
3. The Data Protection (Civil Registration) Regulations, 2020, Legal Notice 196 of 2020
4. The Data Protection (General) Regulations, 2021, Legal Notice 263 of 2021
5. The Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021,
Legal Notice 264 of 2021
Page 3 of 4
6. The Data Protection (Registration of Data Controllers and Processors) Regulations, 2021,
Legal Notice 265 of 2021.
7. Guidance notes from the Office of the Data Protection Commission
8. The ODPC Personal Data Protection Handbook (April 2023)
9. Digital surveillance and big data: Balancing the rights to privacy and security in Kenya
(2024) by Charles .A. Khamala
10. A Comparative Perspective On Privacy Safeguards in Kenya and Uganda Data Protection
Laws (2026): A comparative study by the Centre for Intellectual Property and Information
Technology Law (CIPIT)
11. Data Protection and Right to Privacy Legislation in Kenya by Andrew Matoke Mankone
12. Data Protection Laws of the World by DLA Piper
13. Adequacy of Data Protection Regulation in Kenya by Mugambi Laibuta
14. Data Protection in Kenya by Anne M. Mutie
15. CMS Expert Guide to Data Protection in Kenya
16. Data Protection and Governance Society of Kenya (DPGSK) Analysis of Office of the Data
Protection Commissioner (ODPC) 2024 and 2025 Determinations
Page 4 of 4