An Act of Parliament to give effect to Article 31(c) and (d) of the Constitution; to establish the Office of the Data Protection Commissioner; to make provision for the regulation of the processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors; and for connected purposes.
THE DATA PROTECTION ACT, 2019
3.—Object and purpose of this Act
PART II—ESTABLISHMENT OF THEOFFICE OF THE DATA PROTECTION COMMISSIONER
5.—Establishment of the Office.
6.—Appointment of the Data Commissioner.
7.—Qualifications of the Data Commissioner.
8.—Functions of the Data Commissioner.
9.—Powers of the Office.
10.—Delegation by the Data Commissioner.
11.—Vacancy in the Office of the Data Commissioner.
12.—Removal of the Data Commissioner from office.
13.—Staff of the Office.
14.—Remuneration of the Data Commissioner and staff.
15.—Oath of Office.
17.—Protection from personal liability.
PART III—REGISTRATION OF DATA CONTROLLERS AND DATA PROCESSORS1
8.—Registration of data controllers and data Processors.
19.—Application for registration.
20.—Duration of the registration certificate.
21.—Register of data controllers and data processors.
22.—Cancellation or variation of the certificate.
23.—Compliance and audit.
24.—Designation of the Data Protection Officer.
Other sections Include
PART IV—PRINCIPLES AND OBLIGATIONS OF PERSONAL DATA PROTECTION
PART V—GROUNDS FOR PROCESSING OF SENSITIVE PERSONAL DATA
ART VI—TRANSFER OF PERSONAL DATA OUTSIDE KENYA
PART VIII—ENFORCEMENT PROVISIONS
PART IX—FINANCIAL PROVISIONS
PART X—PROVISIONS ON DELEGATED POWERS
PART XI—MISCELLANEOUS PROVISIONS