Kenya Data Protection Act: A Checklist for Colleges

Under Kenya's Data Protection Act, 2019, a college that collects student, applicant, parent and staff information is a data controller. It must use that data lawfully and only for stated purposes, keep it secure, let people see and correct their data, report serious breaches to the Office of the Data Protection Commissioner (ODPC) within 72 hours, and register with the ODPC where the registration rules apply to it.

Does the Act apply to your college?

Almost certainly. The Act covers anyone who processes personal data of people in Kenya. A college handles a great deal of it: application forms, ID and birth certificate copies, contact details of students and guardians, fee and payment records, results, medical information for some courses, and staff and payroll records.

Some of it is sensitive personal data under the Act, such as health information, which needs extra care.

Register with the ODPC if required

The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 set out who must register with the ODPC and how. They came into force on 14 July 2022. Small organisations, with an annual turnover under KES 5 million and fewer than 10 employees, are generally exempt, but some activities must register whatever their size. Commentary on the regulations reads operating an educational institution as one of them, so assume your college needs to register and confirm it against the regulations or the ODPC's guidance note on registration.

Registration is done online with the ODPC. Software providers that process data on your behalf are data processors, with their own obligations.

Collect only what you need, and say why

• Review your application and admission forms: remove fields you never use.
• Tell applicants, students and staff what you collect, why, and who you share it with (for example examination bodies or sponsors). A short privacy notice on your forms and website does this.
• Decide how long you keep each kind of record, and delete or archive what you no longer need.

Control who can see what

Most college data incidents are internal: a spreadsheet of balances shared too widely, or a former staff member who still has access.

• Give each staff member access only to what their job needs. A lecturer needs class lists and marks, not fee balances or payslips.
• Remove access the day someone leaves.
• Avoid emailing spreadsheets of student data; share access to the system instead.
• Use strong sign-in for people with wide access, such as two-factor authentication for finance and administrators.
• Keep a record of who changed what, so mistakes and misuse can be traced.

Students under 18

Some trainees, particularly in vocational and short courses, are under 18. The Act gives children's data extra protection, and the ODPC has published a guidance note on processing it. Read it before admitting minors, record guardian details at admission, and involve the parent or guardian in decisions about the student's data.

Handle requests from students and staff

People have the right to be told how their data is used, to get a copy of it, to have wrong data corrected and, in some cases, to have it deleted or to object to its use. Decide who in your institution handles these requests and how quickly. Giving students a portal where they can see their own records, statements and results answers many requests before they are made.

Plan for a data breach

If personal data is lost, stolen or exposed and there is a real risk of harm, the Act requires you to notify the Data Commissioner within 72 hours of becoming aware of it, and to tell the people affected where appropriate. Write down now who decides, who contacts the ODPC and how you will contact affected students and staff, so nobody is working it out under pressure.

The checklist

1. Confirm whether you must register with the ODPC, and register if so.
2. List the personal data you collect and why; remove what you do not need.
3. Publish a privacy notice on forms and your website.
4. Set retention periods for each kind of record.
5. Give staff role-based access and remove it when they leave.
6. Turn on two-factor sign-in for privileged accounts.
7. Follow the ODPC's guidance for students under 18, with guardian details on record.
8. Name a person to handle data requests.
9. Write a breach plan with the 72-hour deadline in it.
10. Check that your software providers protect data and let you export and delete it.

This guide is general information, not legal advice. For your institution's specific obligations, consult the Act, the ODPC's guidance or a data protection professional.

Sources

1. Kenya: data protection laws of the world (DLA Piper)
2. The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 (Kenya Law)
3. How the education sector can navigate the data law minefield (Business Daily)
4. Frequently asked questions (Office of the Data Protection Commissioner)

Written by the Soma360 team, who build college management software for Kenyan institutions. Spotted something out of date? Tell us and we will correct it.