Every Kenyan website that collects a name, an email or a phone number is processing personal data , and the Data Protection Act 2019 applies from the first field of the contact form. A privacy policy is where that legal duty becomes visible to users. Does Kenyan law require a privacy policy? The law requires … Read more
A ransom note on the screen. Systems down. Phones ringing. What a business does in the first day of a cyber incident shapes its legal position for months afterwards , and panic is not a plan. What should the first hours of a cyber incident look like? Isolate affected systems to stop the spread, but … Read more
Digital credit grew in Kenya faster than its compliance did, and data protection became the flashpoint: lending apps that harvested phone contacts, listed borrowers publicly, or pressed guarantors through messaging have all faced the consequences. For fintech teams building on that market today, the Data Protection Act 2019 is not an afterthought , it is … Read more
Your HR platform is hosted in Europe. Your customer support runs from India. Your backups sit in a data centre abroad. Each of these ordinary arrangements may involve moving personal data out of Kenya , and that is where the rules begin. Can personal data be transferred outside Kenya? Yes, but not freely. The Data … Read more
A recruitment tool screens out candidates. A chatbot gives a customer wrong information. A model trains on personal data gathered from the web. Kenyan businesses are already using such systems , and asking who answers when they cause loss. Is there an AI law in Kenya? Kenya does not yet have a standalone statute dedicated … Read more
A SaaS subscription looks light: click, pay, log in. Underneath sits a contract that decides who owns the data, who fixes failures and what happens on termination. Reading it before renewal is worth the hour. Which law governs software and SaaS agreements in Kenya? Software licensing and SaaS arrangements are contracts, so the Law of … Read more
Most organisations keep personal data far longer than any purpose justifies , because deleting feels risky and keeping feels safe. The Data Protection Act 2019 takes the opposite view: personal data should be retained no longer than necessary for the purpose collected, and then deleted or anonymised. A retention schedule turns that principle into something … Read more
Your marketing team wants to send ten thousand promotional SMS messages tonight. Before the send button is pressed, Kenyan law asks a simple question: what right do you have to message these people? Do you need consent to send marketing messages in Kenya? Direct marketing is processing, and the Data Protection Act 2019 applies to … Read more
CCTV in the stockroom, software that logs keystrokes, GPS units in delivery vans. Employers have more ways to watch staff than ever, and employees increasingly ask where the line falls under Kenyan law. Can employers monitor employees in Kenya? Monitoring is not banned, but it is regulated. The Data Protection Act 2019 treats employee information … Read more
An email arrives from a customer: “send me everything you hold about me.” Data subject access requests are among the most common exercises of rights under the Data Protection Act 2019, and among the most mishandled , not from obstruction, but because no process is ready when the request lands. What follows is what the … Read more
Email: [email protected] · Contact page
