The Office of the Data Protection Commissioner in Kenya

The Office of the Data Protection Commissioner in Kenya, established under the Data Protection Act, functions as a state authority under Article 260 (q) of the Constitution, consisting of the Data Protection Commissioner as its head and other appointed staff.

Structure and Capabilities:

• The Office acts as a body corporate with perpetual succession and a common seal.
• It has the legal capacity to sue and be sued, manage properties, enter contracts, and conduct necessary legal actions for its function.
• It commits to making its services accessible throughout the Republic.

Directorates Establishment:

• The Data Protection Commissioner, in consultation with the Cabinet Secretary for ICT, establishes directorates to enhance the Office’s function.

Functions of the Office:

• Enforce and oversee the Data Protection Act’s implementation.
• Maintain a register of data controllers and processors.
• Monitor data processing activities, ensuring compliance with the Act.
• Promote self-regulation among data controllers and processors.
• Assess compliance of information processing with legal standards.
• Investigate complaints about rights infringements under the Act.
• Educate the public about the Data Protection Act’s provisions.
• Inspect entities to assess personal data processing practices.
• Facilitate international cooperation on data protection and comply with global obligations.
• Evaluate new personal data handling methods for privacy impacts.
• Undertake additional functions as prescribed by law or necessary for achieving the Act’s objectives.

Collaboration and Independence:

• The Office may work with national security organs, maintaining independence in its function and decision-making under the Act.

Powers of the Office:

• Initiate investigations based on complaints or autonomously.
• Seek external professional or consultative support as needed.
• Mediate and resolve disputes under the Act.
• Summon witnesses for investigations.
• Demand information and assistance from entities governed by the Act.
• Impose fines for non-compliance with the Act.
• Perform activities essential for fulfilling its duties.
• Exercise powers granted by related legislation.

The Office may form strategic partnerships to advance the objectives of the Data Protection Act, both domestically and internationally.