Personal data
Turn privacy obligations into an operating system.
Kenyan data-protection compliance, contracts and incident support that teams can use in day-to-day operations.
Triage · about 2 minutes
Privacy readiness check
Three practical questions. The result is indicative guidance, not legal advice, and nothing is submitted.
- Customers are asking privacy questionsA contract, procurement review or investor process requires clearer evidence of compliance.
- Personal data flows through several toolsThe organisation cannot confidently explain what it collects, why, where it goes or how long it is retained.
- An incident or complaint has occurredThe team needs to preserve facts, assess notification duties and respond consistently.
Your indicative route
Scope & deliverables
What we take responsibility for.
Starting points, not packages forced onto every matter. The final scope is confirmed in writing.
Privacy readiness audit
- Data-use and document review
- Priority gap analysis
- Practical remediation plan
TimingDelivered in stages where the data environment is broad
Compliance documentation
- Privacy notices and policies
- Key data-processing terms
- Implementation guidance
TimingSequenced around the highest-risk uses first
Incident and regulatory support
- Fact and obligation assessment
- Response and notification advice
- Regulatory correspondence within scope
TimingImmediate preservation and escalation decisions come first
ODPC compliance audit matrix
Where Kenyan data protection exposure usually sits.
The obligations we test in an audit, under the Data Protection Act, 2019.
Statutory exposure
Up to KES 5,000,000
or 1% of the preceding year’s annual turnover, whichever is lower, in an administrative penalty notice (section 63). Data subjects may also claim compensation (section 65).
| Obligation | What the audit checks | Reference |
|---|---|---|
| Registration | Whether you must register as a data controller or processor, and that it is current. | s. 18 |
| Notice & lawful basis | A lawful basis for each use, and people told what is collected and why. | ss. 29–30 |
| Data subject rights | A working route for access, correction, objection and deletion requests. | s. 26 |
| Impact assessment | A DPIA before high-risk processing begins. | s. 31 |
| Security & breaches | Safeguards, and a plan to notify the Commissioner within 72 hours of a breach. | s. 43 |
| Cross-border transfers | Appropriate safeguards before data leaves Kenya, including cloud vendors. | ss. 48–50 |
A summary for orientation, not legal advice. Sector rules and ODPC guidance can add obligations.
Process timeline
Know what happens on both sides.
-
Map the real data use
YouIdentify systems, people, vendors and priority data flows.
HTLAWe translate the operation into a usable legal and risk map.
-
Fix what matters first
YouConfirm operational owners and commercial deadlines.
HTLAWe rank obligations by harm, enforcement and business consequence.
-
Embed the controls
YouAssign owners and use the agreed documents and playbooks.
HTLAWe prepare the pack and support practical implementation.
Fee range
Fees set within the Advocates Remuneration Order.
Professional fees exclude VAT and official or third-party disbursements unless the written quote says otherwise.
| Instruction | Fee guidance | Timing |
|---|---|---|
| Privacy readiness audit | Quoted according to organisation and data scope | Delivered in stages where the data environment is broad |
| Compliance documentation | Fixed scope after document inventory | Sequenced around the highest-risk uses first |
| Incident and regulatory support | Quoted according to urgency and exposure | Immediate preservation and escalation decisions come first |
Documents are shared through a private, encrypted intake link, never by email.
Before you instruct
Practical questions.
Clear answers help you decide whether to share documents, book advice or keep researching.
Information on this page is general guidance and does not create an advocate–client relationship. Formal advice begins after conflict checks and written engagement.
What does a practical data-protection audit cover?
The scope can include data uses, legal bases, notices, policies, vendor terms, retention, security responsibilities and incident readiness.
Do all organisations need the same compliance documents?
No. The right pack depends on the people, data, purpose, risk, sector and relationships involved.
Can you assist after a data breach?
Yes. Preserve facts and restrict speculative communication while the incident and any notification duties are assessed.
Can you support an ODPC matter?
Yes, subject to conflict, capacity, the procedural stage and a review of the relevant record.