The Data Protection (Amendment) Bill, 2024

In short

This bill updates Kenya's data protection law. It gives you clearer rights to ask what data an organisation holds about you and to have it deleted. It also sets new penalties for organisations that leak data, and creates exemptions for certain state agencies — the most contested part of the bill.

Clause by clause

1. Clause 6

   Right to erasure

   You may request deletion of your personal data and the organisation must respond within 30 days.

2. Clause 14

   Breach notification

   Organisations must tell you within 72 hours if your data is exposed, and face fines if they stay silent.

3. Clause 22

   State agency exemptions

   Allows named agencies to process data without consent for security purposes. In plain terms: some government bodies can bypass the rules above.