Solution 04

Compliance you can evidence, not just assert

Governance frameworks, data mapping, retention policy, privacy and consent, risk assessment and compliance audits — built around the Kenya Data Protection Act, 2019.

A desk with policy documentation under review

The Data Protection Act, 2019 moved data handling in Kenya from good practice to legal obligation, supervised by the Office of the Data Protection Commissioner. Institutions are expected to know what personal data they hold, why they hold it, on what lawful basis, who can reach it, how long it is kept and what happens when a data subject exercises their rights.

Most organisations cannot answer those questions quickly, not because they are careless but because the information is spread across systems, departments and paper. Governance work is largely the work of making that picture visible, then putting policy, controls and monitoring around it.

What you get

A defensible answer to what personal data you hold and whyRetention applied consistently instead of by department habitData subject requests handled within statutory timelinesEvidence of compliance rather than an assertion of it

What the engagement covers

Scope of the service

Data governance assessmentA baseline of current practice, ownership, controls and gaps, producing a prioritised view of what must be fixed first.

Data protection complianceAssessment against the Data Protection Act, 2019 and its regulations, covering lawful basis, notices, rights handling and breach procedures.

Data classificationA classification scheme that distinguishes public, internal, confidential and sensitive personal data, so controls can be applied proportionately.

Data mappingRecords of processing showing what data is held, where it came from, where it flows, who it is shared with and where it resides.

Retention policiesRetention periods set against statutory requirements and business need, then written into policy and into the systems that hold the data.

Data lifecycle managementGovernance across the whole life of the data — collection, use, sharing, storage, archival and disposal — rather than at the point of capture only.

Privacy & consentPrivacy notices, consent capture and withdrawal, and procedures for access, correction, erasure and objection requests.

Data qualityAccuracy, completeness and duplication addressed, since data that is wrong creates both operational cost and compliance exposure.

Access controlsReview of who can reach what, aligned to role, with excessive and dormant access identified and removed.

Risk assessmentImpact assessments for higher-risk processing, identifying likelihood, consequence and the mitigations that reduce both.

Compliance auditsPeriodic testing of whether the policy is actually operating, producing findings and a tracked remediation plan.

Governance frameworksAccountable roles, decision rights and escalation paths, so data ownership sits with named people rather than with the IT department by default.

Policies & proceduresWritten, approved and usable documentation — the policy set an auditor or the Commissioner will expect to be shown.

Staff trainingRole-appropriate training, because most breaches involve routine human handling rather than technical compromise.

Ongoing monitoringIndicators, reviews and reporting that keep compliance current as systems, vendors and regulations change.

01Discovery & data mappingProcessing activities, systems, data flows and third parties are mapped to establish what is actually held.

02Gap assessmentCurrent practice is tested against the Act and sector obligations, and gaps are rated by risk and effort.

03Framework & policy designGovernance roles, classification, retention and privacy procedures are drafted, reviewed and approved.

04RemediationPriority gaps are closed — access reviews, retention application, notice updates, records cleanup — with progress tracked.

05Monitoring & reviewAudits, training refreshers and reporting keep the framework live rather than a document filed after go-live.

Framed against

Standards this work answers to

Kenya Data Protection Act, 2019Office of the Data Protection Commissioner guidanceGDPR, where clients operate internationallySector regulatory and audit reporting standards

Questions

Common questions

Do we need to register with the Data Protection Commissioner?

Registration as a data controller or processor is required under the Act for entities meeting the prescribed thresholds, and the criteria have specific exemptions. We assess your position as part of the compliance review, but confirmation of your registration obligation should be taken with your legal advisers.

Where should we start if we have done nothing yet?

Does this apply to our paper records too?

Can you act as our Data Protection Officer?

Where this connects

Document DigitizationBulk scanning, OCR, indexing Electronic Records ManagementAccess control, workflow, retention Secure Records ArchivalPhysical, hybrid, disaster recovery Digital Transformation AdvisoryAudit, strategy, change management

Talk to us about data governance & compliance

Tell us about your records environment and we will come back with a structured next step: an assessment, a scope or a proposal.