DATA PROTECTION MANUAL FOR NON-PROFIT ORGANISATIONS IN KENYA

Overview

Kenya’s non-profit organisations handle some of the country’s most sensitive personal information, including beneficiary records, health data, case files, and donor details, often without a clear path to legal compliance. This manual provides non-profit organisations in Kenya with a practical framework to bridge the gap between legal theory under the Data Protection Act, 2019 and real-world application. Developed out of a recognition that data protection is directly tied to the dignity, safety, autonomy, and trust of the communities served, this publication translates complex privacy laws into operational steps for non-profit staff.

Why this toolkit is essential

• Built on Relationships of Trust: Non-profit work relies on community trust, making responsible data handling an ethical and operational necessity.
• Grounded in Constitutional and Statutory Rights: Anchored in Article 31 of the Constitution of Kenya 2010 and operationalized by the Data Protection Act, 2019.
• Tailored for Vulnerable Contexts: Provides specific safeguards for handling sensitive data belonging to survivors of violence, displaced persons, children, and marginalized communities.

Key modules covered in the manual

• Introduction to Privacy: Explores privacy as a fundamental human right under Article 31 of the Constitution of Kenya and outlines multi-dimensional privacy typologies.
• Informational Privacy and Data Protection: Clarifies distinctions between privacy, data protection, and data security, while mapping the full data lifecycle.
• Legal and Regulatory Framework: Examines constitutional foundations alongside international and regional instruments, including the UDHR, ICCPR, GDPR, and the Malabo Convention.
• The Data Protection Act, 2019: Breaks down statutory objects, key definitions, legal contexts such as the Huduma Namba controversy, and subsidiary regulations.
• The Principles of Data Protection: Details the core Section 25 principles including purpose limitation, data minimisation, accuracy, storage limitation, and accountability.
• Lawful Bases for Data Processing: Guides organisations on selecting valid legal grounds under Section 30(1) of the DPA, such as contractual necessity, legal obligation, and legitimate interest.
• Consent and Vital Interests as Lawful Basis: Addresses valid consent conditions, safeguards for vulnerable populations, and emergency decision-making under vital interests.
• Rights of Data Subjects: Explains individual rights under Section 26 of the DPA and operational steps for handling Data Subject Requests (DSRs) within 14-day statutory timelines.