In Kenya, the right to privacy is a fundamental right enshrined in the Constitution, particularly Article 31, and is further protected by the Data Protection Act of 2019. This Act established the Office of the Data Protection Commissioner (ODPC) to regulate the processing of personal data and ensure compliance with data protection principles. 
Key Aspects of Privacy Protection in Kenyan Law:
  • Constitutional Right:
    Article 31 of the Constitution guarantees the right to privacy, which includes the right not to have one's person, home, or property searched, possessions seized, private affairs revealed, or communications infringed. 
  • Data Protection Act, 2019:
    This Act is the primary legal framework for data protection in Kenya, giving effect to the constitutional right to privacy. It outlines the principles for processing personal data, the rights of data subjects, and the obligations of data controllers and processors. 
  • Principles of Data Processing:
    The Data Protection Act establishes principles for data processing, including lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, and integrity. 
  • Data Protection Commissioner:
    The ODPC is responsible for regulating the processing of personal data, ensuring compliance with the Act, and investigating complaints about data breaches. 
  • Rights of Data Subjects:
    Data subjects have the right to access their personal data, request rectification of inaccurate data, object to processing, and request erasure of data. 
  • Obligations of Data Controllers and Processors:
    Data controllers and processors are obligated to comply with the principles of data processing, ensure the security of personal data, and notify the ODPC of data breaches. 
  • Data Transfers:
    The processing of personal data outside of Kenya is subject to specific conditions, including obtaining consent from the data subject and implementing appropriate safeguards, according to the Data Protection Act. 
  • Cybersecurity:
    While the Data Protection Act focuses on data privacy, other legislation like the Computer Misuse and Cybercrimes Act, 2018 addresses cybersecurity issues and criminalizes cybercrimes.