PREREQUISITE FOR TRANSFERRING PERSONAL DATA OUTSIDE KENYA

The Data Protection Act No. 24 of 2019 sets Conditions for transfer personal data out of Kenya and it provides that A data controller or data processor may transfer personal data to another country only where:

1. the data controller or data processor has given proof to the Data Commissioner on the appropriate safeguards with respect to the security and protection of the personal data;
2. the data controller or data processor has given proof to the Data Commissioner of the appropriate safeguards with respect to the security and protection of personal data, and the appropriate safeguards including jurisdictions with commensurate data protection laws;
3. the transfer is necessary
4. for the performance of a contract between the data subject and the data controller or data processor or implementation of pre-contractual measures taken at the data subject’s request;
5. for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another person;
6. for any matter of public interest;
7. for the establishment, exercise or defence of a legal claim;
8. in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent; or
9. for the purpose of compelling legitimate interests pursued by the data controller or data processor which are not overridden by the interests, rights and freedoms of the data subjects.

The act further provides the Safeguards prior to transfer of personal data out of Kenya and it provide that:

1. Where the processing and transfer involves sensitive personal data, the transfer out of Kenya shall only be effected upon obtaining consent of the data subject and on obtaining confirmation of appropriate safeguards.
2. The Data Commissioner may request a person who transfers data to another country to demonstrate the effectiveness of the security safeguards or the existence of compelling legitimate interests.
3. The Data Commissioner may, in order to protect the rights and fundamental freedoms of data subjects, prohibit, suspend or subject the transfer to such conditions as may be determined.

Furthermore, under the Data Protection (General) Regulations, 2021, there are the guiding Principles for the transfer of data outside Kenya. The regulation provides that a data controller or data processor who is a transferring entity shall before transferring personal data out of Kenya ascertain that the transfer is based on:

1. Appropriate safeguards;
2. Adequacy decision made by the Data Commissioner;
3. transfer as a necessity; or
4. consent of the data subject.

It is interesting to note that in the absence of an adequacy decision by Data Commissioner or appropriate safeguards or prerequisites for transfer as a matter of necessity; a transfer of personal data to another country shall take place only on the condition that the data subject:

1. has explicitly consented to the proposed transfer; and
2. has been informed of the possible risks of such transfers.

Where a transfer is based on the consent of a Data subject and in the opinion of the Data Commissioner such transfer poses a risk to the safety of Data and privacy of the Data subject, the Data Commissioner may as well object to such transfer.

At A.O.WANGA ADVOCATES we are happy to assist you in all your Data protection concerns in Kenya.

All rights reserved for A.O.WANGA ADVOCATES