Loi · Data Protection Act, 2019

Ce document constitue le Second Schedule (Annexe 2) de la Data Protection Act, 2019 du Kenya. Il énumère les modifications législatives conséquentes requises par l'entrée en vigueur de la loi sur la protection des données. Il modifie plusieurs lois existantes pour y intégrer les principes de protection des données personnelles, notamment en imposant le respect de ces principes dans la gestion des registres, le traitement des données par les autorités publiques et les organismes régulateurs.

REPUBLIC OF KENYA

KENYA GAZETTE SUPPLEMENT

ACTS, 2019

NAIROBI, 11th November, 2019

CONTENT

Act-

PAGE

The Data Protection Act, 2019.. ..901

NATIONAL COUNCIL FOR LAW REPORTING RECEIVED

18 NOV 2019

MO. Dax 10448- 06106 NAIROBI, KENYA TEL: 2719231 FAX: 2712694

PRINTED AND PUBLISHED BY THE GOVERNMENT PRINTER, NAIROBI

THE DATA PROTECTION ACT

No. 24 of 2019

Date of Assent: 8th November, 2019

Date of Commencement: 25th November, 2019

ARRANGEMENT OF SECTIONS

Sections

Section 1

Article 1

Le présent règlement intérieur a pour objet de fixer les règles de fonctionnement interne de l'entreprise.

Article 2

Il s'applique à l'ensemble du personnel, sans distinction de catégorie ou de fonction.

Section 2

Article 3

Les horaires de travail sont fixés de 8 heures à 17 heures, avec une pause d'une heure à midi.

Article 4

Tout retard ou absence doit être justifié auprès du service du personnel.

PART I—PRELIMINARY

—Short title.
-Interpretation.
—Object and purpose of this Act.
—Application.

PART II—ESTABLISHMENT OF THE OFFICE OF THE DATA PROTECTION COMMISSIONER

—Establishment of the Office.
— Appointment of the Data Commissioner.
—Qualifications of the Data Commissioner.
—Functions of the Data Commissioner.
—Powers of the Office.
—Delegation by the Data Commissioner.
— Vacancy in the Office of the Data Commissioner.
—Removal of the Data Commissioner from office.
—Staff of the Office.
—Remuneration of the Data Commissioner and staff.
—Oath of Office.
—Confidentiality agreements.
—Protection from personal liability.

PART III—REGISTRATION OF DATA CONTROLLERS AND DATA PROCESSORS

18. —Registration of data controllers and data Processors.

19. —Application for registration.

20. —Duration of the registration certificate.

21. —Register of data controllers and data processors.

22. —Cancellation or variation of the certificate.

23. —Compliance and audit.

24. —Designation of the Data Protection Officer.

PART IV-PRINCIPLES AND OBLIGATIONS OF PERSONAL DATA PROTECTION

—Principles of personal data protection.
—Rights of a data subject.
—Exercise of rights by data subject.
—Collection of personal data.
— Duty to notify.
—Lawful processing of personal data.
—Data protection impact assessment.
—Conditions for consent.
—Processing of personal data relating to a child.
—Restriction on processing.
—Automated individual decision making.
—Objecting to processing.
—processing for direct marketing.
—Right to data portability.
—Limitation to retention of personal data.
—Right of rectification and erasure.
—Data protection by design or default.
—Particulars of determining organisational measures.
—Notification and communication of breach.

PART V—GROUNDS FOR PROCESSING OF SENSITIVE PERSONAL DATA

—Processing of sensitive personal data.
-Permitted grounds for processing sensitive personal data.
—Personal data relating to health.
—Further categories of sensitive personal data.

PART VI—TRANSFER OF PERSONAE DATA OUTSIDE KENYA

—Conditions for transfer out of Kenya.
—Safeguards prior to transfer of personal data out of Kenya.