Compliance FrameworksMiddle East & Africa
Kenya Data Protection Act 2019
Kenya Data Protection Act - registration with ODPC, data subject rights, cross-border transfers.
Kenya Data Protection Act - registration with ODPC, data subject rights, cross-border transfers.
| Short name | KE DPA |
| Region | Middle East & Africa |
| Country or scope | Kenya |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers KE DPA
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for KE DPA.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for KE DPA and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
KE-DPA-41 Data Protection by Design and Security Safeguards | Controllers and processors must implement appropriate technical and organizational safeguards, integrated into processing from the design stage, to secure personal data; verifiable integrity across the software inventory evidences those safeguards (DPA 2019 s. 41) | Scan |
KE-DPA-43 Breach Notification Readiness | Breaches posing real risk of harm must be notified to the Data Commissioner and affected data subjects within statutory deadlines; rapid breach scoping requires known versions across the processing software (DPA 2019 s. 43) | Scan |
KE-DPA-18 Registration with the ODPC | Data controllers and processors must register with the Data Commissioner, supplying identifying particulars of their processing; a uniquely identified, timestamped SBOM supports registration-grade documentation of processing systems (DPA 2019 s. 18) | Scan |
KE-DPA-25 Processing Principles Including Accuracy | Personal data must be accurate, kept up to date, and processed in line with the Act's principles; the parallel discipline for the processing environment requires components carrying complete names and versions (DPA 2019 s. 25) | Scan |
KE-DPA-PROC Processing Through Processors | Processing performed on a controller's behalf must be under a written contract with adequate security guarantees, requiring visibility into the suppliers behind the processing software (DPA 2019, processor-engagement provision) | Scan |
KE-DPA-XBORDER Transfer Outside Kenya Readiness | Transfers of personal data outside Kenya require proof of appropriate safeguards or adequacy; determining which systems transfer what requires precisely identifiable components (DPA 2019, conditions for transfer out of Kenya) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
KDPA-S25 | Data Processing Principles (Sections 25-28) |
KDPA-S30 | Consent Requirements (Sections 30-31) |
KDPA-S37 | Data Subject Rights (Section 37) |
KDPA-S41 | Data Security Requirements (Section 41) |
KDPA-S48 | Cross-Border Data Transfers (Section 48) |
KDPA-REG-1 | Data Controller and Processor Registration |
KDPA-DPO-1 | Data Protection Officer Requirements |
Policy templates
Written for KE DPA:
- Kenya DPA: Privacy Notice
- Kenya DPA: Data Breach Notification Procedure
- Kenya DPA: Cross-Border Data Transfer Policy
And 22 from the standard set, adapted to KE DPA.