I Have a DPO. Am I Automatically Data-Compliant?

Appointing a data protection officer is one of the more visible steps a company takes toward complying with the Data Protection Act, 2019, and it is tempting to treat it as the finish line. It is not. A data protection officer (DPO) advises, monitors and cooperates with the regulator. The company still carries the compliance obligations, and the distinction matters more than most businesses realise once something goes wrong.

The obligation sits with the company, not the data protection officer

Section 24(1) of the Act allows a data controller or data processor to designate a data protection officer, including where its core activities involve regular and systematic monitoring of data subjects or the processing of sensitive categories of personal data. Section 24(7) then lists what the officer does: advise the controller or processor and its employees on data processing requirements, ensure on its behalf that the Act is complied with, facilitate staff capacity building, advise on data protection impact assessments, and cooperate with the Data Commissioner.

The duties themselves fall elsewhere. Section 25 places the data protection principles on “every data controller or data processor”. The enforcement tools in sections 58 to 63 are directed at the person in breach: enforcement notices, penalty notices, and administrative fines of up to KES 5 million or, for an undertaking, up to one per cent of its annual turnover for the preceding financial year, whichever is lower. If the company ignores its data protection officer’s advice, or never implements it, the officer having flagged the issue does not move the exposure away from the company. A DPO who is appointed but not listened to protects the company only on paper.

What still has to exist beyond the appointment

Having a named data protection officer does not, by itself, mean any of the following are in place. Each is a separate requirement:

• Registration with the Data Commissioner. Section 18 provides that no person may act as a controller or processor unless registered, subject to the thresholds the Commissioner prescribes.
• Published contact details. Section 24(6) requires the officer’s contact details to be published on the website and communicated to the Data Commissioner.
• A data protection impact assessment before high-risk processing. Section 31 requires one prior to any processing likely to result in high risk to data subjects.
• A lawful basis for each category of personal data you process, and data subject rights procedures that work when someone uses them.
• A breach response plan that meets the notification timelines in section 43.

A DPO can recommend all of this. Only the company can put it in place.

Where this catches companies out

The most common gap is not having no DPO. It is having a DPO whose recommendations sit in an email nobody acted on. If the officer reports to a department that then deprioritises implementation, or if the role was created mainly to answer a client’s due diligence questionnaire, the company’s real exposure has not moved much regardless of the appointment. When the Data Commissioner decides whether to issue a penalty notice and how much to impose, section 62(2) directs attention to the degree of responsibility of the controller or processor, taking into account the technical and organisational measures it actually implemented. What the company did counts for more than the title on the organisation chart.

What actually closes the gap

• Give the DPO direct access to whoever makes decisions, rather than routing findings through several layers of management.
• Treat each recommendation as something to act on or formally decide against in writing, not something to quietly file away.
• Test the substance periodically: are impact assessments being completed, are breach procedures rehearsed, is the register current?
• Check that the officer has no conflicting duties. Section 24(2) permits a staff member to hold the role only if their other tasks do not create a conflict of interest.

A DPO is meant to be the mechanism that gets a company compliant, not a substitute for actually becoming compliant.

Questions to put to your DPO this quarter

• When did we last register or renew our registration with the Data Commissioner, and is it still accurate?
• Which processing operations are high risk, and where is the impact assessment for each?
• What did you recommend in the last twelve months, and which recommendations were implemented, rejected or ignored?
• If a breach occurred tonight, who decides, who notifies and by what time?
• Are the officer’s contact details on our website the current ones?

If management cannot answer these from documents rather than memory, the appointment is not yet doing its job.