5
2019
Data Protection
No.
THE DATA PROTECTION ACT, 2019
AN ACT of Parliament to give effect to Article 31(c)
and (d) of the Constitution; to establish the Office
of the Data Protection Commissioner; to make
provision for the regulation of the processing of
personal data; to provide for the rights of data
subjects and obligations of data controllers and
processors; and for connected purposes
ENACTED by Parliament of Kenya, as follows—
PART I—PRELIMINARY
1. This Act may be cited as the Data Protection Act,
2019.
2. In this Act, unless the context otherwise requires—
“anonymisation” means the removal of personal
identifiers from personal data so that the data subject is no
longer identifiable;
“biometric data’’ means personal data resulting from
specific technical processing based on physical,
physiological or behavioural characterisation including
blood typing, fingerprinting, deoxyribonucleic acid
analysis, earlobe geometry, retinal scanning and voice
recognition;
“Cabinet Secretary” means the Cabinet Secretary
responsible for matters relating to information,
communication and technology;
“consent” means any manifestation of express,
unequivocal, free, specific and informed indication of the
data subject’s wishes by a statement or by a clear
affirmative action, signifying agreement to the processing
of personal data relating to the data subject;
“data” means information which—
(a) is processed by means of equipment operating
automatically in response to instructions given for
that purpose;
(b) is recorded with intention that it should be
processed by means of such equipment;
(c) is recorded as part of a relevant filing system;
Short title.
Interpretation.
!