Kenya: Data Protection Act including cross-border data transfer regulation entered into force

On 25 November 2019, Data Protection Act, 2019 entered into force. The Act includes provisions that regulate the transfer of personal data outside Kenya. It stipulates that personal data can be transferred internationally if adequate data protection safeguards are in place or with the consent of the data subject. Data controllers or processors must demonstrate to the Data Commissioner that adequate security measures are in place for such transfers. The Act also allows transfers necessary for contractual obligations, legal claims, or public interest, provided that the data subject's rights are protected.