The Office of the Data Protection Commissioner in Kenya

The Data Protection Act establishes the Office of the Data Protection Commissioner in Kenya. The Office is a State Office under Article 260 (q) of the Constitution.

The Office shall comprise the Data Protection Commissioner as its head and accounting officer and other staff appointed by theData Protection Commissioner.

The Office of the Data Protection Commissioner in Kenya shall be a body corporate with perpetual succession and a common seal and shall, in its corporate name, be capable of–

• suing and being sued;
• taking, purchasing or otherwise acquiring, holding, charging or disposing of movable and immovable property;
• entering into contracts; and
• doing such other legal acts necessary for the proper performance of the functions of the Office.

The Office shall ensure reasonable access to its services in all parts of the Republic.

The Data Protection Commissioner shall establish such directorates as may be necessary for the better carrying of the functions of the Office in consultation with the Cabinet Secretary (responsible for matters relating to information, communication and technology).

Functions of the Office of the Data Protection Commissioner

The functions of the Office of the Data Protection Commissioner in Kenya shall be to–

• oversee the implementation of and be responsible for the enforcement of The Data Protection Act;
• establish and maintain a register of data controllers and data processors;
• exercise oversight on data processing operations, either of own motion or at the request of a data subject (an identified or identifiable natural person who is the subject of personal data) and verify whether the processing of data follows The Data Protection Act;
• promote self-regulation among data controllers and data processors;
• conduct an assessment, on its own initiative or at the request of a private or public body, to ascertain whether information is processed according to the provisions of The Data Protection Act or any other relevant law;
• receive and investigate any complaint by any person on infringements of the rights under The Data Protection Act;
• take such measures as may be necessary to bring the provisions of The Data Protection Act to the knowledge of the general public;
• carry out inspections of public and private entities to evaluate the processing of personal data;
• promote international cooperation in matters relating to data protection and ensure the country’s compliance with data protection obligations under international conventions and agreements;
• investigate innovations in the handling of personal data and make sure they pose no serious threat to individual privacy or have any adverse effects; and
• perform such other functions any other law may prescribe or as necessary for promoting the object of The Data Protection Act.

The Office of the Data Protection Commissioner may collaborate with the national security organs in the performance of its functions.

The Data Protection Commissioner shall act independently when exercising powers and performing functions under The Data Protection Act.

Powers of the Office of the Data Protection Commissioner

The powers of the Office of the Data Protection Commissioner in Kenya are to–

• conduct investigations on own initiative or the basis of a complaint made by a data subject or a third party;
• obtain professional assistance, consultancy or advice from such persons or organisations within or outside public service as considered appropriate;
• facilitate conciliation, mediation and negotiation on disputes arising from The Data Protection Act;
• issue summons to a witness for investigation;
• require any person that is subject to The Data Protection Act to provide explanations, information and assistance in person and writing;
• impose administrative fines for failures to comply with The Data Protection Act;
• undertake any activity necessary for the fulfilment of any of the functions of the Office of the Data Protection Commissioner; and
• exercise any powers prescribed by any other legislation.

To further the goals of The Data Protection Act, the Office of the Data Protection Commissioner in Kenya may form partnerships with other entities or organisations both inside and outside of Kenya.

For more information about the Office of the Data Protection Commissioner, see the Data Protection Act.