The Data Protection (General) Regulations 2021 (the \u201cGeneral Regulations\u201d)<\/strong><\/p>\n

The general structure of the General Regulations was retained from the draft form. Most changes made were to firm up the rights of Data Subjects and the duties of Data Controllers. Below are some additional comments on the General Regulations.<\/p>\n

In addition to the responsibilities of Data Controllers, the General Regulations now require a Data Controller or Data Processor who collects personal data indirectly, to inform the Data Subject of the collection within fourteen days.<\/p>\n

Data Controllers and Data o Processors are also required to implement elements of the principle of fairness. These include granting Data Subjects the highest degree of autonomy with respect to control over their personal data; enabling a Data Subject to communicate and exercise their rights; and incorporating human intervention to minimize biases caused by automated decision-making processes.<\/p>\n

The provisions on the transfer of data outside Kenya have been bolstered to provide for transfers to international organisations involved in law enforcement. Transfer to such organizations requires there to be in place safeguard mechanisms containing appropriate safeguards for the protection of personal data. These mechanisms should bind the intended recipient of the personal data and should essentially be equivalent to the protections under the Act. Alternatively, the Data Controller must assess all the circumstances surrounding transfers of that type of personal data outside the country, and determine that appropriate safeguards exist.<\/p>\n