Did you know that Kenya is going through a major digital transformation? Yep, they’re bringing a bunch of public services onto digital platforms. But with this move comes the need to protect people’s personal data. That’s where the Office of the Data Protection Commissioner (ODPC) steps in.

See, it’s a constitutional right for all Kenyan citizens (or as they’re legally called, data subjects) to have their data safeguarded. They don’t want anyone getting their hands on that info and using it for shady purposes. So, the ODPC was set up in November 2020, after the Data Protection Act of 2019 was passed. Their job is to make sure that personal data is handled according to the rules laid out in that Act.

Now, Susan Waweru, the Head of Legal Services at ODPC, says their office also has the responsibility of educating Data Controllers and Processors on how to play by the rules. To get started, these folks need to register with the ODPC. That’s the first step in being in compliance with the Data Protection Act.

Abdullahi Ali, one of the Advocacy officers at ODPC, is on a mission to spread awareness throughout all the counties in Kenya. By the end of this financial year, he wants every single county to know what the ODPC is all about, what the data protection Act says, and what everyone’s obligations are when it comes to keeping data safe.

Just the other day, Ali was speaking at an event in Embu County, and he had some wise words for data controllers and processors. He told them to take responsibility for the information they have and use it only for its intended purpose. No funny business allowed! He also reminded them to be careful about the data they collect. Only grab what you really need, so you can minimize the risk of things like fraud or annoying marketing tactics from sneaky entities that might try to snatch that data illegally.

Ali also mentioned something called a Data Protection Impact Assessment (DPIA). It’s a way for data collectors and processors to identify any risks in their work and deal with them head-on. Gotta make sure there are no data breaches, right? And hey, he suggested having a schedule for how long to keep information. Once it’s served its purpose, it should be disposed of properly and lawfully.

Oh, and here’s an important tip from Mr. Ali: If a data collector shares private data with another party for processing, they better have a contract in place. That contract needs to lay out all the details about how that information will be handled. Can’t be too careful!

Now, there’s one more person we need to mention. Mercy Gatobu, the Deputy County Commissioner of Embu West, attended the same event and showed her full support for the ODPC. She knows that lots of government departments deal with heaps of personal and sensitive data while serving the public. It’s crucial to protect that info from getting out there where it shouldn’t be.

So, there you have it! Kenya is stepping up its data protection game, ensuring that personal information is treated with care and kept safe. It’s all part of this digital transformation going on.