Comparing the Kenya Data Protection Act of 2019 to the GDPR
The Kenya Data Protection Act of 2019 and the General Data Protection Regulation (GDPR) are both laws that establish rules for the collection, use, and protection of personal data. Here is a comparison of the two laws:
Scope of the Laws
One key difference between the Kenya Data Protection Act of 2019 and the GDPR is the scope of the laws. The Kenya Data Protection Act of 2019 applies only to organizations operating in Kenya, while the GDPR applies to organizations operating in the European Union (EU) and European Economic Area (EEA).
The GDPR applies to the processing of personal data by controllers and processors established in the EU or EEA, regardless of whether the processing takes place in the EU or EEA. This means that organizations outside the EU or EEA that process the personal data of EU or EEA residents are subject to the GDPR.
On the other hand, the Kenya Data Protection Act of 2019 applies to the processing of personal data by controllers and processors established in Kenya, as well as to the processing of personal data by controllers and processors established outside Kenya if the processing relates to the offering of goods or services to individuals in Kenya or the monitoring of their behavior in Kenya.
Principles of Data Protection
Both the Kenya Data Protection Act of 2019 and the GDPR establish principles for data protection, such as purpose limitation, data minimization, and data accuracy. These principles require organizations to collect and use personal data only for specific, explicit, and legitimate purposes and to collect and use only the minimum amount of personal data necessary for those purposes. They also require organizations to ensure that personal data is accurate and kept up to date.
Rights of Individuals
Both the Kenya Data Protection Act of 2019 and the GDPR give individuals certain rights in relation to their personal data, such as the right to access, rectify, erase, and object to the processing of their data. These rights enable individuals to exercise control over their personal data and ensure that it is used in an appropriate and transparent manner.
Technical and Organizational Measures
Both the Kenya Data Protection Act of 2019 and the GDPR require organizations to implement appropriate technical and organizational measures to protect personal data. These measures can include encryption, access controls, data masking, and data anonymization, among others. The specific measures required will depend on the nature and sensitivity of the personal data being processed, as well as the risks to the rights and freedoms of individuals.
Fines for Non-Compliance
The GDPR has higher fines for non-compliance compared to the Kenya Data Protection Act of 2019. Under the GDPR, organizations can be fined up to 20 million euros or 4% of the total worldwide annual revenue of the preceding financial year, whichever is higher. By contrast, the Kenya Data Protection Act of 2019 provides for fines of up to 5 million Kenya shillings for non-compliance, with higher fines for more serious offenses.
Conclusion
The Kenya Data Protection Act of 2019 and the GDPR are both laws that establish rules for the collection, use, and protection of personal data. While there are some similarities between the two laws, there are also some key differences, such as the scope of the laws, the principles of data protection, the rights of individuals, and the fines for non-compliance. It is important for organizations operating in Kenya and the EU or EEA to be aware of these differences and ensure compliance with the relevant laws.
