Data and Compliance Policy

Effective Date: 1/07/2026
Last Updated: 30/06/2026

1. Introduction

Kakuma Blogging is committed to the highest standards of data protection and regulatory compliance. This Data and Compliance Policy outlines our approach to data governance, regulatory compliance, and the protection of user rights.

2. Regulatory Framework

Kakuma Blogging complies with the following legal frameworks:

2.1 Kenya Data Protection Act, 2019

Primary Law: Data Protection Act No. 24 of 2019
Regulations: Data Protection (General) Regulations, 2021
Enforcement Body: Office of the Data Protection Commissioner (ODPC)

2.2 International Standards

GDPR: General Data Protection Regulation (EU) 2016/679
Best Practices: We align with international data protection best practices

2.3 Kenyan Constitution

Article 31(c) and (d) : Right to privacy as a fundamental human right

3. Data Protection Principles

We adhere to the following data protection principles as required by the Data Protection Act, 2019:

Principle	Our Commitment
Lawfulness, Fairness, Transparency	We process data lawfully, fairly, and transparently
Purpose Limitation	We collect data for specified, explicit, and legitimate purposes
Data Minimization	We collect only data that is adequate, relevant, and necessary
Accuracy	We ensure data is accurate and keep it up to date
Storage Limitation	We retain data only as long as necessary
Integrity and Confidentiality	We protect data against unauthorized access and loss
Accountability	We are responsible for and can demonstrate compliance

4. Data Controller and Processor Roles

4.1 Data Controller

Kakuma Blogging acts as the Data Controller for personal data processed through our platform. We determine the purposes and means of processing personal data.

4.2 Data Processors

We may engage third-party Data Processors to process personal data on our behalf. These processors are bound by contractual obligations to protect data and comply with the Data Protection Act.

5. Registration with ODPC

Under Section 18 of the Data Protection Act, 2019, all data controllers and processors must register with the ODPC.

Kakuma Blogging is registered with the ODPC in compliance with this requirement.

Exemption Note: Data controllers or processors with an annual turnover below 5 million shillings and employing fewer than 10 people are exempt from mandatory registration.

6. Data Subject Rights Compliance

We have established procedures to honor the rights of data subjects under the Data Protection Act, 2019:

Right	Implementation
Right to be Informed	Privacy notices on the platform
Right to Access	Data access request process (7-day response)
Right to Rectification	Users can update their profile information
Right to Erasure	Account deletion and data removal options
Right to Restrict Processing	Privacy settings to control data use
Right to Data Portability	Data export functionality
Right to Object	Objection mechanism for certain processing

7. Data Breach Management

7.1 Definition

A data breach is any incident where personal data is compromised or taken from a system without authorization.

7.2 Breach Response Procedure

Detection and Assessment: Identify and assess the breach
Containment: Limit the impact of the breach
Notification: Notify affected data subjects and the ODPC as required
Investigation: Determine cause and prevent recurrence
Documentation: Record the breach and actions taken

7.3 Reporting Obligations

We report data breaches to the ODPC within 72 hours of becoming aware of the breach, where feasible.

8. Data Protection by Design and Default

We integrate data protection principles into the design of our platform:

Privacy by Design: Privacy considerations are embedded in product development
Privacy by Default: The strictest privacy settings are applied by default
Data Minimization: We collect only necessary data
Purpose Limitation: Data is used only for specified purposes

9. Data Protection Impact Assessments (DPIAs)

We conduct Data Protection Impact Assessments for processing activities that may present high risks to data subjects. DPIAs help us identify and mitigate privacy risks before processing begins.

10. Consent Management

10.1 Obtaining Consent

We obtain clear, explicit, and informed consent for processing personal data, especially for sensitive data.

10.2 Withdrawal of Consent

Users can withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

10.3 Record of Consent

We maintain records of when and how consent was obtained.

11. Third-Party Compliance

11.1 Vendor Assessments

We assess third-party vendors for data protection compliance before engaging them.

11.2 Data Processing Agreements

We have Data Processing Agreements (DPAs) with all third-party processors, including:

Data processing purposes and scope
Security measures
Data subject rights procedures
Breach notification obligations

11.3 Monitoring

We periodically review third-party compliance with data protection obligations.

12. Compliance Monitoring and Audits

12.1 Internal Audits

We conduct regular internal audits to assess compliance with data protection policies and legal requirements.

12.2 External Audits

We may engage external auditors to provide independent assessments of our data protection practices.

12.3 ODPC Inspections

We cooperate fully with ODPC inspections and investigations.

13. Training and Awareness

13.1 Staff Training

All team members receive training on data protection principles, security practices, and compliance obligations.

13.2 User Education

We provide users with information about their data rights and how to protect their privacy.

Office of the Data Protection Commissioner (ODPC):

Website: www.odpc.go.ke
Email: info@odpc.go.ke
Phone: 0207801800