# dpa_questions

category: Legal Basis & Lawful Processing
kenya_dpa_reference: Section 30, Kenya DPA 2019
question:
  Has your organization identified and documented a lawful basis for every personal data processing activity?

guidance:
  DPA requires at least one of: consent, contract, legal obligation, vital interests, public task, or legitimate interests.


category: Legal Basis & Lawful Processing
guidance: Consent must be specific, informed, and unambiguous. Pre-ticked boxes are not valid consent.
kenya_dpa_reference: Section 32, Kenya DPA 2019
question:
  Do you obtain explicit, informed, and freely given consent from data subjects before processing their personal data?


category: ODPC Registration & Governance
guidance: Registration is mandatory under DPA Section 18. Failure attracts a KES 1,000,000 fine.
kenya_dpa_reference: Section 18, Kenya DPA 2019
question:
  Is your organisation registered as a Data Controller/Processor with the Office of the Data Protection Commissioner (ODPC)?


category: Data Subject Rights
question: Do data subjects have a clear mechanism to access their personal data held by your organization?
kenya_dpa_reference: Section 26, Kenya DPA 2019
guidance:
  Right of access must be fulfilled within 21 days of request. Provide data in a commonly used format.


category: Privacy Notices & Transparency
guidance: Privacy notice must be concise, transparent, intelligible and in plain language.
kenya_dpa_reference: Section 29, Kenya DPA 2019
question:
  Do you have a clear, accessible privacy notice/policy published and made available to data subjects?


category: Data Minimisation & Retention
guidance: Retention periods must be justified, documented, and communicated to data subjects.
kenya_dpa_reference: Section 25(e), Kenya DPA 2019
question:
  Do you have a documented data retention schedule with defined retention periods for each data category?


category: Data Processors & Third Parties
guidance: Written contracts with processors are mandatory. They must only act on documented instructions.
kenya_dpa_reference: Section 46, Kenya DPA 2019
question:
  Do you have Data Processing Agreements with all third-party processors handling personal data on your behalf?


category: Cross-Border Data Transfers
kenya_dpa_reference: Section 48, Kenya DPA 2019
question:
  Do you transfer personal data outside Kenya? If yes, have you ensured adequate safeguards are in place?

guidance:
  International transfers require an adequacy decision or appropriate safeguards (SCCs, BCRs, or explicit consent).


category: Website & Digital Compliance
question: Does your website have a functional cookie consent mechanism with granular opt-in controls?
kenya_dpa_reference: Section 32, Kenya DPA 2019
guidance:
  Tracking cookies require explicit opt-in consent. Pre-consent cookies are limited to essential only.


# dpa_recommendations

risk_level: critical,very-high,high
category: ODPC Registration
priority: immediate
timeframe: 30 days
legal_reference: Section 18, Kenya DPA 2019
penalty_risk: KES 1,000,000 fixed penalty
recommendation:
  Register as a Data Controller/Processor with the Office of the Data Protection Commissioner (ODPC). Non-registration carries a mandatory KES 1,000,000 fine.


