Data Protection Compliance for Media and Technology Companies in Kenya

Data protection compliance for media and technology companies in Kenya starts with the Data Protection Act, No. 24 of 2019, which applies to organisations that collect or process personal data, including media houses, digital publishers, technology platforms and app developers. Our general guide to the Data Protection Act 2019 sets out the framework; this article applies it to media and technology businesses.

Data Protection Compliance: The Journalism Provision

Section 52 is narrower than many publishers assume. It provides that the principles of processing personal data do not apply where the processing is for the publication of literary or artistic material, the controller reasonably believes publication would be in the public interest, and the controller reasonably believes compliance with the provision is incompatible with the special purposes. Section 52(2) adds that the public interest limb applies only where the processing complies with any self-regulatory or issued code of ethics relevant to the publication. Section 52(3) requires the Data Commissioner to prepare a code of practice on processing for journalism, literature and art.

The provision is directed at editorial publication. It does not exempt a media organisation from registration, security or its commercial processing, and audience data used for advertising or subscriber management should be treated as ordinary personal data.

Registration with the Data Commissioner

Section 18(1) provides that no person shall act as a data controller or data processor unless registered with the Data Commissioner, subject to thresholds the Commissioner prescribes. Under regulation 13 of the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, a controller or processor is exempt from mandatory registration only if it has annual turnover or revenue below five million shillings and fewer than ten employees. That exemption does not apply to a controller or processor whose annual turnover is below five million shillings but that processes personal data for the purposes in the Third Schedule. A certificate of registration is valid for twenty-four months from issue under regulation 9, so registration must be renewed on that cycle.

A media company with a subscriber database or a technology company running a platform will usually fall outside the exemption. The Registration Regulations should be checked against the organisation’s actual turnover, headcount and processing purposes.

Lawful Basis for Processing

Section 30(1) permits processing only where the data subject consents for specified purposes, or the processing is necessary for a listed purpose, including performing a contract, complying with a legal obligation, protecting vital interests, a public interest task, the legitimate interests pursued by the controller or a third party (unless unwarranted by harm to the data subject’s rights), or historical, statistical, journalistic, literature and art or scientific research purposes. Section 30(3) makes contravention an offence by the controller.

In practice, consent suits newsletters and direct marketing, contract suits paid subscriptions, and legitimate interests may suit analytics and security monitoring, but only after weighing the harm to data subjects. Consent must meet the conditions in section 32. Further processing must be in line with the purpose of collection (section 30(2)).

Data Subject Rights

Section 26 gives a data subject the right to be informed of the use of their data, to access it, to object to processing of all or part of it, to correction of false or misleading data, and to deletion of false or misleading data. Sections 34 (restrictions on processing), 38 (data portability) and 40 (rectification and erasure) provide for further requests. Under the Data Protection (General) Regulations, 2021, a controller must act on a request to restrict processing within fourteen days. Establish a documented procedure for every type of request and check the Regulations for the time limit that applies to each.

Processors, Security and Breach Notification

A technology company that processes data for clients should operate under a written agreement that records the controller’s instructions, and should not process outside them. Sections 41 and 42 require data protection by design or by default and organisational measures appropriate to the risk. Under section 43, where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the data subject, the controller must notify the Data Commissioner without delay, within seventy-two hours of becoming aware of it.

Cross-Border Transfers

Section 48 conditions the transfer of personal data out of Kenya on listed safeguards or grounds, such as the data subject’s consent or the transfer being necessary for a contract or a legal claim. Section 49(1) provides that sensitive personal data may be processed outside Kenya only with the data subject’s consent and confirmation of appropriate safeguards, and section 49(2) lets the Data Commissioner ask a transferor to demonstrate the effectiveness of its safeguards. Companies using cloud infrastructure outside Kenya should map their transfers against these sections.

Enforcement

The Data Commissioner may issue enforcement notices (section 58) and penalty notices (section 62). Under section 63, the maximum penalty in a penalty notice is up to five million shillings or, for an undertaking, up to one per cent of its annual turnover for the preceding financial year, whichever is lower. A data subject may also seek compensation under section 65.

Building a Compliance Programme

A workable programme covers a data inventory, a lawful basis analysis for each processing activity, privacy notices at every collection point, a request-handling procedure, a review of processor agreements and a breach response plan. For media organisations, keep editorial processing separate from commercial uses such as advertising targeting, with their own lawful basis and notices, since only the former can fall within section 52.