Implementation Of Kenya's Data Protection (General) Regulations, 2021

Since the enactment of the Data Protection Act (the DPA) in 2019, and the establishment of the Office of the Data Protection Commissioner in 2020, the issuance of regulations necessary to give effect to many of the provisions contained in the DPA has long been awaited. This changed on 11 February 2022 when the regulations came into force, including the Data Protection (General) Regulations, 2021 (General Regulations), the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021, and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.

In the first instalment of a continuing series of articles analysing these regulations, we examine the General Regulations, which provide for the various instances which trigger obligations for data controllers and data processors to data subjects.