41
2019
Data Protection
No.
(a) the requirements which are imposed on a data
controller or data processor when processing
personal data;
(b) mechanisms of conducting certification program;
(c) the contents which a notice or registration by a
data controller or data processor should contain;
(d) information to be provided to a data subject and
how such information shall be provided;
(e) the levying of fees and taking of charges;
(f) the measures to safeguard a data subject’s rights,
freedoms and legitimate interests;
(g) the processing of data through a data server or data
centre in Kenya;
(h) issuing and approval of codes of practice and
guidelines; or
(i) any other matter that the Cabinet Secretary may
deem fit.
(3) For the purposes of Article 94(6) of the
Constitution—
(a) the purpose and objective of the delegation under
this section is to enable the Cabinet Secretary to
make regulations for better carrying into effect the
provisions of this Act;
(b) the authority of the Cabinet Secretary to make
regulations under this Act will be limited to
bringing into effect the provisions of this Act and
fulfilment of the objectives specified under this
section.
(4) The principles and standards applicable to the
delegated power referred to under this Act are those found
in—
(a) the Statutory Instruments Act, 2013;
(b) the Interpretation and General Provisions Act;
(c) the general rules of international law as specified
under Article 2(5) of the Constitution; and
(d) any treaty and convention ratified by Kenya under
Article 2(6) of the Constitution.
No. 23 of 2013.
Cap 2.
!