Data is the new oil. This saying underpins the importance of data in this modern era. Data privacy and protection laws have come to protect and guide how personal data should be processed and handled. It is not possible to run many businesses without using or processing personal data. Personal data refers to information which can be used to identify a person e.g. name, identity card number, bank account, telephone number, photo etc. The data privacy laws stipulate stiff penalties for individuals or organizations who do not comply with the laws e.g. an administrative penalty of KES 5 Million per instance of violation or 1% of the annual turnover. This is in addition to fines and imprisonment of the owners, managers or anyone else found guilty of violating the law.

In this document, we outline how Lex Compliance & Data Ltd Advocates can assist your organization to comply with privacy data laws applicable to your organization. This covers aspects such as registration and certification as Data Processors and Data Controllers, trainings, developing policies and procedures, offering Data Protection Officer services, data breach management, cross border transfer of data amongst other services. We are a team of experienced data privacy professionals, lawyers and consultants who have supported various multi-national organizations to comply with data privacy laws in addition to handling data privacy emergencies. We have supported clients across various markets such as Kenya, Uganda, Rwanda, Nigeria and other countries. We are here to walk with you to ensure that your business and operations are safeguarded from data privacy risks.

With increased digitalization and rapid growth of social media, data privacy and protection has become a critical risk for organizations to manage. The General Data Protection Regulations(GDPR) came into force on 25th May 2018 which applies at global level with special emphasis to personal data in Compliance & Data Privacy Services relation to European Union citizens/residents. The Kenyan Data Protection Act 2019 (DPA) came into force on 25th November 2019, flowing from Article 31 of the Constitution of Kenya, which grants every person the right to privacy. In July 2022, the Data Privacy Regulations were issued to operationalize the DPA. The DPA imposes significant obligations onorganizations that are established in Kenya or are situated outside Kenya but process personal data of subjects located in Kenya. The DPA 2019 stipulates a penalty of KES 5M or 1% of a company’s revenue as administrative penalties. In addition, company managers/owners/executivescan be imprisoned or fined by court as defined by DPA. The administrative penalties are levied by the Office of the Data Protection Commissioner (ODPC).

Data protection and privacy is a multidisciplinary problem hence we provide an end-to-end service. Our data privacy compliance and advisory team can help you unpack the requirements of the GDPR and the DPA and develop a comprehensive program to mitigate the risks. Our team can assist you to streamlinesthe processes, ensuring your organization gets our expert implementation services and maximizesthe benefits of data privacy management quickly and efficiently.