Registration Is The Easy Part

The Data Protection Act obliges a controller to process personal data lawfully, for a stated purpose, and no longer than necessary. Every one of those tests is applied per category of data and per purpose - which means you cannot answer any of them until you know what you hold and why.

That document is the record of processing, and it is unglamorous: a table listing each category of personal data, the purpose it is processed for, the lawful basis relied on, who it is shared with, where it is stored, and how long it is kept. Most organisations discover, in building it, that they hold considerably more than they thought - CCTV footage, recruitment files for candidates never hired, WhatsApp groups containing customer details, spreadsheets on personal laptops.

Until that table exists, a privacy policy is a statement of intent about data nobody has inventoried.

Organisations reach for consent because it feels safest. It is usually the least robust option available, because consent must be freely given and capable of being withdrawn - and when it is withdrawn, the processing must stop.

For most ordinary business processing there is a better basis. Payroll and statutory deductions are processed to comply with a legal obligation. Fulfilling a customer order is performance of a contract. Fraud monitoring on your own systems is generally a legitimate interest, provided it is documented and proportionate.

Pick the basis per purpose, write down why, and stop asking for consent you do not need - an employee cannot meaningfully refuse their employer, and a consent that could not have been refused will not carry weight.

Kenyan businesses keep everything, indefinitely, because storage is cheap and deleting feels risky. Under the Act, holding personal data beyond the period necessary for its purpose is itself a breach - and it enlarges every other exposure you have, because a breach reaches whatever you were still holding.

Retention periods are not arbitrary. They fall out of other law: tax records have a statutory retention period, employment records have their own, and company records have theirs. Set the period from the longest applicable obligation, write it into the record of processing, and then actually run the deletion.

The last step is the one that does not happen. A retention schedule nobody executes is evidence that you identified the obligation and did not meet it, which is a worse position than not having written it down.

The Act requires notification of the Data Commissioner where a breach presents a real risk of harm to the data subject, within a short window, and communication to affected data subjects in defined circumstances.

A short window is not enough time to decide who decides. Settle it in advance: who is told first, who assesses the risk of harm, who authorises notification, who drafts the communication, and who talks to affected people. Put it on one page and rehearse it once.

Most breaches are not sophisticated attacks. They are a laptop left in a matatu, a payroll file emailed to the wrong distribution list, a departing employee with a copy of the customer database. Each of those is survivable with a plan and expensive without one.