Kenya: Office of the Data Protection Commissioner closes consultation on draft Guidance Notes on Data Protection Policy

On 15 May 2026, the Kenya Office of the Data Protection Commissioner closes the consultation on the draft Guidance Notes on Data Protection Policy. The draft Guidance Notes apply to all data controllers and data processors across all sectors, and the Kenya Office of the Data Protection Commissioner issues the draft Guidance Notes under Regulation 23 of the Data Protection (General) Regulations 2021, which requires data handlers to develop, publish, and regularly update a data protection policy. The draft Guidance Notes would set out the minimum required elements of a data protection policy, including the principles of data protection, the lawful bases for processing personal data under the Data Protection Act No. 24 of 2019, and the roles and responsibilities of data controllers, data processors, data protection officers, employees, and senior management. The draft Guidance Notes would further require data handlers to establish data subject rights management and complaints handling mechanisms, implement technical and organisational measures for the protection of personal data, and put in place procedures for data breach management, including notification of the Data Commissioner within 72 hours and notification of the data controller by data processors within 48 hours. The draft Guidance Notes would additionally cover data retention and disposal schedules, vendor management, data transfer safeguards, and training and awareness programmes, as well as periodic policy review and compliance monitoring.