33
2019
Data Protection
No.
(2) The Data Commissioner may request a person who
transfers data to another country to demonstrate the
effectiveness of the security safeguards or the existence of
compelling legitimate interests.
(3) The Data Commissioner may, in order to protect
the rights and fundamental freedoms of data subjects,
prohibit, suspend or subject the transfer to such conditions
as may be determined.
50. The Cabinet Secretary may prescribe, based on
grounds of strategic interests of the state or protection of
revenue, certain nature of processing that shall only be
effected through a server or a data centre located in Kenya.
Processing
through a data
server or data
centre in Kenya.
PART VII— EXEMPTIONS
51. (1) Nothing in this Part shall exempt any data
controller or data processor from complying with data
protection principles relating to lawful processing,
minimisation of collection, data quality, and adopting
security safeguards to protect personal data.
General
exemptions.
(2) The processing of personal data is exempt from the
provisions of this Act if—
(a) it relates to processing of personal data by an
individual in the course of a purely personal or
household activity;
(b) if it is necessary for national security or public
interest; or
(c) disclosure is required by or under any written law
or by an order of the court.
52. (1) The principles of processing personal data shall
not apply where—
(a) processing is undertaken by a person for the
publication of a literary or artistic material;
(b) data controller reasonably believes that publication
would be in the public interest; and
(c) data controller reasonably believes that, in all the
circumstances, compliance with the provision is
incompatible with the special purposes.
(2) Subsection (1)(b) shall only apply where it can be
demonstrated that the processing is in compliance with any
Journalism,
literature and art.
!