You are planning a new app, a CCTV rollout or a loyalty programme. If the project processes personal data on a large scale or in sensitive ways, Kenyan law may expect a data protection impact assessment before you launch. Doing it early is cheaper than retrofitting compliance after launch.
When is a data protection impact assessment required in Kenya?
A data protection impact assessment (DPIA) is a structured examination of a proposed processing operation and the risks it poses to the people whose data will be handled. Under the Data Protection Act 2019, it is associated with processing likely to result in high risk , for instance large-scale processing, systematic monitoring of publicly accessible areas, handling of sensitive categories of data, or the large-scale use of new technologies. The test is risk, not industry: a small retailer introducing facial-recognition cameras may need one, while a large employer adding a plain payroll module may not.
What does a DPIA involve?
- A description of the processing: what data, from whom, for what purpose, shared with whom.
- An assessment of necessity and proportionality against that purpose.
- Identification of risks to data subjects, from profiling to security failure.
- Mitigation measures such as limiting access, anonymising fields or shortening retention.
- Sign-off and a date for review once the system is live.
Who should carry out the assessment?
The controller remains responsible even where vendors or consultants do the technical work. A DPIA is most useful when legal, IT and the business unit owning the project all contribute, and when the findings feed into system design and supplier contracts rather than sitting in a drawer. Our contract lawyers can align the supplier agreements with the assessment’s findings. Organisations producing DPIAs repeatedly often fold them into a broader governance framework so the method stays consistent , see our governance advisory services. Asking these questions at design stage costs far less than rebuilding a system that cannot be justified.
The Office of the Data Protection Commissioner publishes guidance on high-risk processing, and the Data Protection Act 2019 is available on Kenya Law.
For guidance on your specific situation, contact CS Advocates LLP , call, WhatsApp, or book a confidential consultation at our Westlands, Nairobi office.