ICT, Data Privacy and AI Lawyers in Nairobi

Registration is mandatory for certain controllers and processors and not for others. The obligation turns on the nature of your processing and whether you meet the thresholds in the Data Protection Act and the guidance published by the Office of the Data Protection Commissioner, and it applies to many organisations that assume it does not. Registration is a regulated process with its own requirements, and operating without it when it is required creates exposure. See ODPC registration and controller versus processor.

Yes, but not automatically. The law permits transfers only where an appropriate safeguard applies, which may include the destination having adequate protection, your own binding corporate rules, or contractual clauses that protect the data, and you have to be able to show the basis. In practice the harder question is factual: data often leaves Kenya through backup, remote support and sub-processors without the business realising it. Map the actual flows before deciding the safeguard. See cross-border data transfers and the transfer checklist.

It must be written in clear language and tell the data subject what you collect, why you collect it, the lawful basis, who you share it with, whether it goes outside Kenya, how long you keep it, and how to exercise their rights including access, correction and objection. A policy copied from a template frequently describes processing the business does not do while omitting what it actually does, which is worse than having none. See website privacy policy requirements and handling access requests.

You need to be able to detect, assess and notify. The Act requires notification to the Office of the Data Protection Commissioner in prescribed circumstances and, where a breach is likely to result in high risk to data subjects, communication to those individuals as well. The clock matters and so does the record: what happened, when you knew, what data and how many people, and what you did about it. An incident response plan prepared before an incident is what makes the difference. See data breach notification and cyber incident response.

Only within limits, and never simply because the device belongs to the employer. Monitoring engages both the Data Protection Act and the employee’s right to privacy, and it requires a lawful basis, transparency, and proportionality to a legitimate purpose. Blanket surveillance of personal communications is very unlikely to be justified. A defensible approach usually means a clear policy, notice to staff, narrow scope, and defined retention. See employee monitoring and workplace privacy and workplace monitoring under the Act.