Webinar: What to expect as a business when handling personal data in Kenya

Paul-Jasper Dittrich from BMDS welcomed the participants and underlined the significance of data protection compliance for companies seeking to process data in Kenya.

"Once a German company comes into Kenya, its data challenges become relevant to Kenya."

Valerie Kutima and Boniface Gathee from the ODPC presented the Kenyan data protection legal framework. They explained that the Kenyan data protection act is very similar to the GDPR, and both laws are founded on key principles of data protection. The main difference is that there is no principle of accountability under Kenyan law. Further significant differences between the Kenyan Data Protection Act (DPA) and the GDPR include:

1. Commercial use/direct marketing: Kenya is more consent-forward & explicitly restricts commercial use of personal data.
2. Transfers: Kenya adds the "proof to ODPC" emphasis; GDPR relies on formal tools often without prior authorisation.
3. Localisation: Kenya has an explicit localisation mechanism for certain processing.
4. Data portability requests: In Kenya, portability requests must be complied with “at reasonable cost” (and within 30 days) while the GDPR states that such requests from data subjects should be processed free of charge by default.
5. Penalties: Kenya's administrative fine cap is far lower than GDPR’s top-tier fine model.

What German companies can do to set themselves up for compliance

The ODPC classifies companies that deal with any personal data as data processers or controllers. These entities must register with the ODPC if the data they deal with comes from data subjects located in Kenya. This is independent of whether the processing entity is located in Kenya.

Registration can be completed fully online via dataportal.odpc.go.ke and companies can expect a decision from ODPC within two weeks. The registration fee charged is based on total turnover and number of employees, for which proof must be provided and a registration certificate is issued, valid for two years.

Enabling companies through self-appointed data protection officers

The ODPC expects companies to actively take steps to safeguard the data. It promotes self-regulation and offers a training to empower companies to comply with data protection laws independently. Further, it is expected that every company which meets ODPC’s mandatory registration threshold must appoint a data protection officer who notifies the data commissioner in case of data breaches. Non-compliance with data protection regulations will result in a notice from the ODPC and must be rectified within 60 days to avoid penalties.

Responding to questions from participants, the ODPC clarified that the protection of personal data also applies to foreigners and foreign businesses that operate in Kenya.

In conclusion, the ODPC webinar provided practical knowledge for German companies, ensuring that they can operate smoothly and responsibly within the Kenyan digital landscape.