The Data Protection Act, 2019 introduced new requirements for all businesses in Kenya that process personal data. The Office of the Data Protection Commissioner (ODPC) enforces these requirements, with penalties of up to KES 5 million or 1% of annual turnover for non-compliance. Anyega Osiemo & Co. Advocates assists organisations in achieving compliance and responding to data breaches.
Our data protection services include
- Compliance audits and gap analysis – Assessing your data collection, storage, and sharing practices against the Data Protection Act.
- ODPC registration – Registering data controllers and data processors with the ODPC.
- Privacy policies and notices – Drafting privacy policies, data protection notices, and consent frameworks for websites, apps, HR, and marketing.
- Data processing agreements – Contracts between controllers and processors that satisfy Section 42 of the Act.
- Breach response and 72-hour notification – Incident response planning, managing active breaches, and notifying the ODPC within the mandatory 72 hours.
- Staff training and DPIAs – Data protection impact assessments to embed compliance in daily operations.
- ODPC complaints and enforcement – Defending organizations against ODPC complaints and penalty notices.
Don’t wait for a breach or an ODPC letter. WhatsApp our data protection team or book a compliance review.
