Kenya: Office of the Data Protection Commissioner adopted guidance on consent under Data Protection Act

On 30 November 2023, the Office of the Data Protection Commissioner (ODPC) adopted the "Guidance Notes on Consent" to clarify the requirements for obtaining consent under the Data Protection Act, 2019. The guidance outlines the conditions for valid consent, which must be freely given, informed, specific, and given through an unequivocal action by the data subject. It establishes that consent must be sought before processing personal data, and data controllers and processors are required to provide clear, concise, and easily understandable information to the data subject regarding the processing purpose and the right to withdraw consent. The guidance also stipulates that consent cannot be coerced, and data subjects must have a genuine choice. If consent is withdrawn, the data controller or processor must cease processing unless another lawful basis exists. The guidance also highlights the responsibility of data controllers and processors to prove that valid consent has been obtained and maintained throughout the processing activity.