suing and being sued;

taking, purchasing or otherwise acquiring, holding, charging or disposing of movable and immovable property;

entering into contracts; and

doing such other legal acts necessary for the proper performance of the functions of the Office.

consider the applications received to determine their compliance with this Act;

shortlist qualified applicants;

publish and publicise the names of the applicants and the shortlisted applicants;

conduct interviews of the shortlisted persons in an open and transparent process;

nominate three qualified applicants in the order of merit for the position of Data Commissioner; and

submit the names of the persons nominated under paragraph (e) to the President.

has knowledge and relevant experience of not less than ten years;

meets the requirements of Chapter Six of the Constitution; and

holds a Master's degree.

oversee the implementation of and be responsible for the enforcement of this Act;

establish and maintain a register of data controllers and data processors;

exercise oversight on data processing operations, either of own motion or at the request of a data subject, and verify whether the processing of data is done in accordance with this Act;

promote self-regulation among data controllers and data processors;

conduct an assessment, on its own initiative of a public or private body, or at the request of a private or public body for the purpose of ascertaining whether information is processed according to the provisions of this Act or any other relevant law;

receive and investigate any complaint by any person on infringements of the rights under this Act;

take such measures as may be necessary to bring the provisions of this Act to the knowledge of the general public;

carry out inspections of public and private entities with a view to evaluating the processing of personal data;

promote international cooperation in matters relating to data protection and ensure country's compliance on data protection obligations under international conventions and agreements;

undertake research on developments in data processing of personal data and ensure that there is no significant risk or adverse effect of any developments on the privacy of individuals; and

perform such other functions as may be prescribed by any other law or as necessary for the promotion of object of this Act.

conduct investigations on own initiative, or on the basis of a complaint made by a data subject or a third party;

obtain professional assistance, consultancy or advice from such persons or organisations whether within or outside public service as considered appropriate;

facilitate conciliation, mediation and negotiation on disputes arising from this Act;

issue summons to a witness for the purposes of investigation;

require any person that is subject to this Act to provide explanations, information and assistance in person and in writing;

impose administrative fines for failures to comply with this Act;

undertake any activity necessary for the fulfilment of any of the functions of the Office; and

exercise any powers prescribed by any other legislation.

investigate the matter expeditiously;

report on the facts; and

make a recommendation to the Cabinet Secretary.

informed, in writing, of the reasons for the intended removal; and

offered an opportunity to put in a defence against any such allegations.

the nature of industry;

the volumes of data processed;

whether sensitive personal data is being processed; and

any other criteria the Data Commissioner may specify.

a description of the personal data to be processed by the data controller or data processor;

a description of the purpose for which the personal data is to be processed;

the category of data subjects, to which the personal data relates;

contact details of the data controller or data processor;

a general description of the risks, safeguards, security measures and mechanisms to ensure the protection of personal data;

any measures to indemnify the data subject from unlawful use of data by the data processor or data controller; and

any other details as may be prescribed by the Data Commissioner.

the processing is carried out by a public body or private body, except for courts acting in their judicial capacity;

the core activities of the data controller or data processor consist of processing operations which, by virtue of their nature, their scope or their purposes, require regular and systematic monitoring of data subjects; or

the core activities of the data controller or the data processor consist of processing of sensitive categories of personal data.

advise the data controller or data processor and their employees on data processing requirements provided under this Act or any other written law;

ensure on behalf of the data controller or data processor that this Act is complied with;

facilitate capacity building of staff involved in data processing operations;

provide advice on data protection impact assessment; and

co-operate with the Data Commissioner and any other authority on matters relating to data protection.

the data is contained in a public record;

the data subject has deliberately made the data public;

the data subject has consented to the collection from another source;

the data subject has an incapacity, the guardian appointed has consented to the collection from another source;

the collection from another source would not prejudice the interests of the data subject;

the data subject consents to the processing for one or more specified purposes; or

a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the data controller or data processor;

an assessment of the necessity and proportionality of the processing operations in relation to the purposes;

an assessment of the risks to the rights and freedoms of data subjects;

the measures envisaged to address the risks and the safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Act, taking into account the rights, and legitimate interests of data subjects and other persons concerned.

consent is given by the child's parent or guardian; and

the processing is in such a manner that protects and advances the rights and best interests of the child.

available technology;

volume of personal data processed;

proportion of such personal data likely to be that of a child;

possibility of harm to a child arising out of processing of personal data; and

such other factors as may be specified by the Data Commissioner.

accuracy of the personal data is contested by the data subject, for a period enabling the data controller to verify the accuracy of the data;

personal data is no longer required for the purpose of the processing, unless the data controller or data processor requires the personal data for the establishment, exercise or defence of a legal claim;

processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; or

data subject has objected to the processing, pending verification as to whether the legitimate interests of the data controller or data processor overrides those of the data subject.

the personal data shall, unless the data is being stored, only be processed with the data subject's consent or for the establishment, exercise or defence of a legal claim, the protection of the rights of another person or for reasons of public interest; and

the data controller shall inform the data subject before withdrawing the restriction on processing of the personal data.

necessary for entering into, or performing, a contract between the data subject and a data controller;

authorised by a law to which the data controller is subject and which lays down suitable measures to safeguard the data subject's rights, freedoms and legitimate interests; or

based on the data subject's consent.

the data controller or data processor must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing; and

consider the request, including any information provided by the data subject that is relevant to it;

comply with the request; and

has sought and obtained express consent from a data subject; or

is authorised to do so under any written law and the data subject has been informed of such use when collecting the data from the data subject.

processing may be necessary for the performance of a task carried out in the public interest or in the exercise of an official authority; or

it may adversely affect the rights and freedoms of others.

required or authorised by law;

reasonably necessary for a lawful purpose;

authorised or consented by the data subject; or

for historical, statistical, journalistic literature and art or research purposes.

to rectify without undue delay personal data in its possession or under its control that is inaccurate, out-dated, incomplete or misleading; or

to erase or destroy without undue delay personal data that the data controller or data processor is no longer authorised to retain, irrelevant, excessive or obtained unlawfully.

the rectification of such personal data in their possession or under their control that is inaccurate, out-dated, incomplete or misleading; or

the erasure or destruction of such personal data that the data controller is no longer authorised to retain, irrelevant, excessive or obtained unlawfully.

to implement the data protection principles in an effective manner; and

to integrate necessary safeguards for that purpose into the processing.

the amount of personal data collected;

the extent of its processing;

the period of its storage;

its accessibility; and

the cost of processing data and the technologies and tools used.

to identify reasonably foreseeable internal and external risks to personal data under the person's possession or control;

to establish and maintain appropriate safeguards against the identified risks;

to the pseudonymisation and encryption of personal data;

to the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

to verify that the safeguards are effectively implemented; and

to ensure that the safeguards are continually updated in response to new risks or deficiencies.

the state of technological development available;

the cost of implementing any of the security measures;

the special risks that exist in the processing of the data; and

the nature of the data being processed.

the data controller shall opt for a data processor who provides sufficient guarantees in respect of organisational measures for the purpose of complying with section 41(1); and

the data controller and the data processor shall enter into a written contract which shall provide that the data processor shall act only on instructions received from the data controller and shall be bound by obligations of the data controller.

notify the Data Commissioner without delay, within seventy-two hours of becoming aware of such breach; and

subject to subsection (3), communicate to the data subject in writing within a reasonably practical period, unless the identity of the data subject cannot be established.

description of the nature of the data breach;

description of the measures that the data controller or data processor intends to take or has taken to address the data breach;

recommendation on the measures to be taken by the data subject to mitigate the adverse effects of the security compromise;

where applicable, the identity of the unauthorised person who may have accessed or acquired the personal data; and

the name and contact details of the data protection officer where applicable or other contact point from whom more information could be obtained.

the facts relating to the breach;

its effects; and

the remedial action taken.

by or under the responsibility of a health care provider; or

by a person subject to the obligation of professional secrecy under any law.

is necessary for reasons of public interest in the area of public health; or

is carried out by another person who in the circumstances owes a duty of confidentiality under any law.

to the risk of significant harm that may be caused to a data subject by the processing of such category of personal data;

to the expectation of confidentiality attached to such category of personal data;

to whether a significantly discernible class of data subjects may suffer significant harm from the processing of such category of personal data; and

to the adequacy of protection afforded by ordinary provisions applicable to personal data.

it relates to processing of personal data by an individual in the course of a purely personal or household activity;

if it is necessary for national security or public interest; or

disclosure is required by or under any written law or by an order of the court.

processing is undertaken by a person for the publication of a literary or artistic material;

data controller reasonably believes that publication would be in the public interest; and

data controller reasonably believes that, in all the circumstances, compliance with the provision is incompatible with the special purposes.

data is processed in compliance with the relevant conditions; and

results of the research or resulting statistics are not made available in a form which identifies the data subject or any of them.

practical guidance in relation to the sharing of personal data in accordance with the requirements of the data protection legislation; and

such other guidance as the Commissioner considers appropriate to promote good practice in the sharing of personal data.

attend at a specified time and place for the purpose of being examined orally in relation to the complaint;

produce such book, document, record or article as may be required with respect to any matter relevant to the investigation, which the person is not prevented by any other enactment from disclosing; or

furnish a statement in writing made under oath or on affirmation setting out all information which may be required under the notice.

specify the provision of this Act which has been, is being or is likely to be, contravened;

specify the measures that shall be taken to remedy or eliminate the situation which makes it likely that a contravention will arise;

specify a period which shall not be less than twenty-one days within which those measures shall be implemented; and

state any right of appeal.

to the nature, gravity and duration of the failure;

to the intentional or negligent character of the failure;

to any action taken by the data controller or data processor to mitigate the damage or distress suffered by data subjects;

to the degree of responsibility of the data controller or data processor, taking into account technical and organisational measures;

to any relevant previous failures by the data controller or data processor;

to the degree of co-operation with the Data Commissioner, in order to remedy the failure and mitigate the possible adverse effects of the failure;

to the categories of personal data affected by the failure;

to the manner in which the infringement became known to the Data Commissioner, including whether, and if so to what extent, the data controller or data processor notified the Data Commissioner of the failure;

to the extent to which the data controller or data processor has complied with previous enforcement notices or penalty notices;

to adherence to approved codes of conduct or certification mechanisms;

to any other aggravating or mitigating factor applicable to the case, including financial benefits gained, or losses avoided, as a result of the failure (whether directly or indirectly);

to whether the penalty would be effective, proportionate and dissuasive.

a data controller involved in processing of personal data is liable for any damage caused by the processing; and

the payment of salaries, allowances and other charges in respect of the staff of the Office;

the payment of pensions, gratuities and other charges in respect of retirement benefits which are payable out of the finances of the Office;

the acquisition, maintenance, repair and replacement of the equipment and other movable property of the Office;

funding of training, research and development of activities of the Office;

the creation of such reserve funds to meet future or contingent liabilities or in respect of such other matters as the Data Commissioner may deem fit; and

any other expenditure for the purposes of this Act.

the financial statements and description of activities of the Office;

such other statistical information as the Data Commissioner may consider appropriate relating to the Data Commissioner's functions;

the impact of the exercise of any of Data Commissioner's mandate or function;

any impediments to the achievements of the object and purpose of this Act or any written law; and

any other information relating to its functions that the Data Commissioner may consider necessary.

the requirements which are imposed on a data controller or data processor when processing personal data;

mechanisms of conducting certification program;

the contents which a notice or registration by a data controller or data processor should contain;

information to be provided to a data subject and how such information shall be provided;

the levying of fees and taking of charges;

the measures to safeguard a data subject's rights, freedoms and legitimate interests;

the processing of data through a data server or data centre in Kenya;

issuing and approval of codes of practice and guidelines; or

any other matter that the Cabinet Secretary may deem fit.

the purpose and objective of the delegation under this section is to enable the Cabinet Secretary to make regulations for better carrying into effect the provisions of this Act;

the authority of the Cabinet Secretary to make regulations under this Act will be limited to bringing into effect the provisions of this Act and fulfilment of the objectives specified under this section.

the Statutory Instruments Act (Cap. 2A);

the Interpretation and General Provisions Act (Cap. 2);

the general rules of international law as specified under Article 2(5) of the Constitution; and

any treaty and convention ratified by Kenya under Article 2(6) of the Constitution.

obtains access to personal data, or obtains any information constituting such data, without prior authority of the data controller or data processor by whom the data is kept; or

discloses personal data to third party, commit an offence.

order the forfeiture of any equipment or any article used or connected in any way with the commission of an offence; or

order or prohibit the doing of any act to stop a continuing contravention.

issue guidelines or codes of practice for the data controllers, data processors and data protection officers;

offer data protection certification standards and data protection seals and marks in order to encourage compliance of processing operations with this Act;

require certification or adherence to code of practice by a third party;

develop sector specific guidelines in consultation with relevant stakeholders in areas such as health, financial services, education, social Protection and any other area as the Data Commissioner may determine.