Legal insights
ICT, Data Privacy & AI Law
Kenyan ICT, data protection and AI law for organisations that process personal data. These guides cover the Data Protection Act 2019, registration and data protection impact assessments, lawful bases and consent, data subject access requests, breach notification, cross-border transfers, employee monitoring, fintech and digital lending, software and SaaS contracts, cyber incident response, and the governance questions a board should ask before buying an AI tool. Each article identifies the regulator guidance, the records to keep and the steps to take before a project or dispute escalates.
When Is a DPIA Required in Kenya?
You are planning a new app, a CCTV rollout or a loyalty programme. If the project processes personal data on a large scale or…
Read the noteEmployee Monitoring and Privacy in Kenya
CCTV in the stockroom, software that logs keystrokes, GPS units in delivery vans. Employers have more ways to watch staff than ever, and employees…
Read the noteData Retention in Kenya: How Long?
Most organisations keep personal data far longer than any purpose justifies — because deleting feels risky and keeping feels safe. The Data Protection Act…
Read the noteData Protection for Digital Lenders
Digital credit grew in Kenya faster than its compliance did, and data protection became the flashpoint: lending apps that harvested phone contacts, listed borrowers…
Read the noteCyber Incident Response in Kenya
A ransom note on the screen. Systems down. Phones ringing. What a business does in the first day of a cyber incident shapes its…
Read the noteBiometric Data Under the Data Protection Act
Fingerprints, facial images and voice recordings identify a person as nothing else can — and Kenyan law treats them accordingly. Biometric data falls within…
Read the noteLiability for AI Systems in Kenya
A recruitment tool screens out candidates. A chatbot gives a customer the wrong information. A model is trained on personal data gathered from the…
Read the noteData Subject Access Requests in Kenya
An email arrives from a customer: "send me everything you hold about me." Data subject access requests are among the most common exercises of…
Read the noteNeed advice on a Kenyan matter?
Speak to a lawyer or advocate.
Tell us what is at stake and any deadline. An advocate will confirm whether the firm can act, explain the next step and call you back within one business day.