New rules for schools, churches and residential buildings with CCTV cameras

Kenya has inched closer to concrete personal data protection protocols with the latest announcement from Data Commissioner Immaculate Kassait.

Commissioner Kassait added learning institutions, churches, landlords and security firms operating closed-circuit television cameras (CCTV) to the list of those required to offer special security measures as data handlers.

The list also includes; political campaigners, gaming/ betting firms, banks, CRBs, technology firms and transport service providers.

The institutions will now be required to adhere to the provisions of the Data Protection Act in handling, storing and sharing the data they collect.

President Uhuru Kenyatta signed the Act into law in November 2019 and appointed Ms Kassait to the Data Commissioner position in 2020.

The Data Commission has set a one-off certification fee of Sh250,000 plus between Sh1,000 and Sh20,000 annul renewal fees for Data Commissioners and Data Controllers.

A "data controller” means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of processing of personal data.

A "data processor" is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.