# website_scan_cache

domain: rvibs.ac.ke
scan_date: 2026-05-21 13:25:01
scan_data:
  {"success":true,"url":"https:\/\/rvibs.ac.ke","domain":"rvibs.ac.ke","scan_date":"2026-05-21 13:25:00","checks":{"https":{"status":"pass","label":"HTTPS\/TLS Encryption","finding":"\u2705 Website uses HTTPS encryption","score":100,"detail":"URL: https:\/\/rvibs.ac.ke\/ | HTTP Status: 200","recommendation":null},"privacy_policy":{"status":"pass","label":"Privacy Policy","finding":"\u2705 Privacy policy found on website","score":90,"detail":"Privacy mentions: 6 | Links found: Yes","recommendation":null},"cookie_consent":{"status":"warning","label":"Cookie Consent","finding":"\u26a0\ufe0f No cookie consent detected (cookies may not be used)","score":50,"detail":"Cookies detected: No | Consent mechanism: No","recommendation":null},"web_forms":{"status":"warning","label":"Web Form Security","finding":"\u26a0\ufe0f 1 form(s): Some improvements needed","score":50,"detail":"Total forms: 1 | HTTPS: 1 | Privacy notices: 0","recommendation":"Ensure all forms use HTTPS and include privacy notices per DPA Section 29."}},"overall_website_score":73,"overall_status":"Needs Improvement \u26a0\ufe0f"}


domain: efhub.com
scan_date: 2026-05-22 19:26:22
scan_data:
  {"success":true,"url":"https:\/\/efhub.com","domain":"efhub.com","scan_date":"2026-05-22 19:26:22","checks":{"https":{"status":"pass","label":"HTTPS\/TLS Encryption","finding":"\u2705 Website uses HTTPS encryption","score":100,"detail":"URL: https:\/\/efhub.com\/ | HTTP Status: 200","recommendation":null},"privacy_policy":{"status":"pass","label":"Privacy Policy","finding":"\u2705 Privacy policy found on website","score":100,"detail":"Privacy mentions: 10 | Links found: Yes","recommendation":null},"cookie_consent":{"status":"fail","label":"Cookie Consent","finding":"\u274c Website uses cookies but no consent mechanism found","score":10,"detail":"Cookies detected: Yes | Consent mechanism: No","recommendation":"Implement a cookie consent banner with opt-in controls per DPA Section 32."},"web_forms":{"status":"pass","label":"Web Form Security","finding":"\u2705 No forms detected (no collection risk)","score":100,"detail":"Total forms: 0 | HTTPS: 0 | Privacy notices: 0","recommendation":null}},"overall_website_score":78,"overall_status":"Needs Improvement \u26a0\ufe0f"}


domain: www.kuccps.net
scan_date: 2026-05-22 19:38:13
scan_data:
  {"success":true,"url":"https:\/\/www.kuccps.net","domain":"www.kuccps.net","scan_date":"2026-05-22 19:38:13","checks":{"https":{"status":"pass","label":"HTTPS\/TLS Encryption","finding":"\u2705 Website uses HTTPS encryption","score":100,"detail":"URL: https:\/\/www.kuccps.net\/ | HTTP Status: 200","recommendation":null},"privacy_policy":{"status":"pass","label":"Privacy Policy","finding":"\u2705 Privacy policy found on website","score":80,"detail":"Privacy mentions: 4 | Links found: Yes","recommendation":null},"cookie_consent":{"status":"warning","label":"Cookie Consent","finding":"\u26a0\ufe0f No cookie consent detected (cookies may not be used)","score":50,"detail":"Cookies detected: No | Consent mechanism: No","recommendation":null},"web_forms":{"status":"warning","label":"Web Form Security","finding":"\u26a0\ufe0f 1 form(s): Some improvements needed","score":50,"detail":"Total forms: 1 | HTTPS: 1 | Privacy notices: 0","recommendation":"Ensure all forms use HTTPS and include privacy notices per DPA Section 29."}},"overall_website_score":70,"overall_status":"Needs Improvement \u26a0\ufe0f"}


domain: jooust.ac.ke
scan_date: 2026-05-24 12:06:48
scan_data:
  {"success":true,"url":"https:\/\/jooust.ac.ke","domain":"jooust.ac.ke","scan_date":"2026-05-24 12:06:46","checks":{"https":{"status":"pass","label":"HTTPS\/TLS Encryption","finding":"\u2705 Website uses HTTPS encryption","score":100,"detail":"URL: https:\/\/jooust.ac.ke\/ | HTTP Status: 200","recommendation":null},"privacy_policy":{"status":"fail","label":"Privacy Policy","finding":"\u274c No privacy policy found on website","score":0,"detail":"Privacy mentions: 0 | Links found: No","recommendation":"Publish a comprehensive privacy policy as required by DPA Section 29."},"cookie_consent":{"status":"warning","label":"Cookie Consent","finding":"\u26a0\ufe0f No cookie consent detected (cookies may not be used)","score":50,"detail":"Cookies detected: No | Consent mechanism: No","recommendation":null},"web_forms":{"status":"warning","label":"Web Form Security","finding":"\u26a0\ufe0f 1 form(s): Some improvements needed","score":50,"detail":"Total forms: 1 | HTTPS: 1 | Privacy notices: 0","recommendation":"Ensure all forms use HTTPS and include privacy notices per DPA Section 29."}},"overall_website_score":50,"overall_status":"Needs Improvement \u26a0\ufe0f"}


domain: kplc.co.ke
scan_date: 2026-06-03 13:00:24
scan_data:
  {"success":true,"url":"https:\/\/kplc.co.ke","domain":"kplc.co.ke","scan_date":"2026-06-03 13:00:21","checks":{"https":{"status":"pass","label":"HTTPS\/TLS Encryption","finding":"\u2705 Website uses HTTPS encryption","score":100,"detail":"URL: https:\/\/kplc.co.ke\/ | HTTP Status: 200","recommendation":null},"privacy_policy":{"status":"pass","label":"Privacy Policy","finding":"\u2705 Privacy policy found on website","score":60,"detail":"Privacy mentions: 0 | Links found: Yes","recommendation":null},"cookie_consent":{"status":"fail","label":"Cookie Consent","finding":"\u274c Website uses cookies but no consent mechanism found","score":10,"detail":"Cookies detected: Yes | Consent mechanism: No","recommendation":"Implement a cookie consent banner with opt-in controls per DPA Section 32."},"web_forms":{"status":"warning","label":"Web Form Security","finding":"\u26a0\ufe0f 1 form(s): Some improvements needed","score":50,"detail":"Total forms: 1 | HTTPS: 1 | Privacy notices: 0","recommendation":"Ensure all forms use HTTPS and include privacy notices per DPA Section 29."}},"overall_website_score":55,"overall_status":"Needs Improvement \u26a0\ufe0f"}


domain: odpc.go.ke
scan_date: 2026-06-03 13:00:51
scan_data:
  {"success":true,"url":"https:\/\/odpc.go.ke","domain":"odpc.go.ke","scan_date":"2026-06-03 13:00:44","checks":{"https":{"status":"pass","label":"HTTPS\/TLS Encryption","finding":"\u2705 Website uses HTTPS encryption","score":100,"detail":"URL: https:\/\/www.odpc.go.ke\/ | HTTP Status: 200","recommendation":null},"privacy_policy":{"status":"pass","label":"Privacy Policy","finding":"\u2705 Privacy policy found on website","score":75,"detail":"Privacy mentions: 3 | Links found: Yes","recommendation":null},"cookie_consent":{"status":"warning","label":"Cookie Consent","finding":"\u26a0\ufe0f No cookie consent detected (cookies may not be used)","score":50,"detail":"Cookies detected: No | Consent mechanism: No","recommendation":null},"web_forms":{"status":"warning","label":"Web Form Security","finding":"\u26a0\ufe0f 1 form(s): Some improvements needed","score":50,"detail":"Total forms: 1 | HTTPS: 1 | Privacy notices: 0","recommendation":"Ensure all forms use HTTPS and include privacy notices per DPA Section 29."}},"overall_website_score":69,"overall_status":"Needs Improvement \u26a0\ufe0f"}


# chatbot_logs

message: resistartion cost
created_at: 2026-05-19 11:29:33
reply:
  💰 **ODPC Registration Fees**

  Fees are set by the ODPC and vary based on your organisation type. As a guide:

  • **Small organisations / startups:** Lower tier fee
  • **Medium organisations:** Mid-tier fee
  • **Large organisations / multinationals:** Higher tier fee

  ⚠️ **Check the official ODPC website (odpc.go.ke)** for the current fee schedule, as these can change.

  **Payment is made online** during the registration process.

  💡 Contact Soul Guard's **ODPC Registration Service** — we can guide you through the exact fees for your organisation size and type.


message: fees
created_at: 2026-05-19 11:50:57
reply:
  I don't have a specific answer for that question yet.

  For expert guidance on this topic, please contact the **Soul Guard compliance team** directly:

  📧 **Email:** support@soulguard.co.ke
  🌐 **Platform:** Use the **Help & Support** section in your dashboard
  📞 **ODPC Direct:** +254 752 896 867 | +254 796 954 269
  🏢 **ODPC Office:** 12th Floor, Britam Tower, Hospital Road, Upperhill, Nairobi

  In the meantime, I can help you with:
  • **"What is a DPIA?"** — impact assessments
  • **"72-hour breach rule"** — notification obligations
  • **"ODPC registration fees"** — exact fee schedule
  • **"Data subject rights"** — access, erasure, portability
  • **"My compliance score"** — personalised analysis
  • **"Data protection principles"** — the 7 key principles


message: hello
created_at: 2026-05-19 12:06:27
reply:
  Good afternoon, **there**! 👋

  I'm **Israel**, your Data Protection Assistant — powered by the official **ODPC Personal Data Protection Handbook** and Kenya's **Data Protection Act 2019**.

  Here's what I can help you with today:

  📋 **Compliance Fundamentals** — 7 principles, DPIAs, lawful basis, RoPA
  🏛️ **ODPC Requirements** — registration fees, process, exemptions, enforcement
  🚨 **Breach Management** — 72-hour ODPC rule, 48-hour processor rule
  ⚖️ **Data Subject Rights** — access, erasure, portability, 21-day response
  👤 **DPO & Governance** — data sharing agreements, processor management
  📝 **ODPC Complaints** — how to lodge, investigation timeline (90 days)
  📊 **Your Dashboard** — type **"my score"** for a personalised overview

  What would you like to know, there?


message: how can i complain?
created_at: 2026-05-19 12:07:10
reply:
  Hi there, I'm Israel — your Data Protection Assistant. I don't have a specific answer for that question yet.

  For expert guidance on this topic, please contact the **Soul Guard compliance team** directly:

  📧 **Email:** support@soulguard.co.ke
  🌐 **Platform:** Use the **Help & Support** section in your dashboard
  📞 **ODPC Direct:** +254 752 896 867 | +254 796 954 269
  🏢 **ODPC Office:** 12th Floor, Britam Tower, Hospital Road, Upperhill, Nairobi

  In the meantime, I can help with:
  • **"What is a DPIA?"** — impact assessments
  • **"72-hour breach rule"** — notification obligations
  • **"ODPC registration fees"** — exact fee schedule from the Handbook
  • **"Data subject rights"** — all 8 rights
  • **"Data protection principles"** — the 7 key principles
  • **"My compliance score"** — personalised analysis
  • **"How to complain to ODPC"** — step-by-step guide


message: who are you
created_at: 2026-05-19 12:11:27
reply:
  🤖 **I'm your Kenya DPA 2019 Compliance Assistant!**

  Here's what I can help with:

  📋 **Compliance Fundamentals**
  • Data Protection Impact Assessments (DPIAs)
  • Lawful basis for processing
  • Special categories of sensitive data
  • Record of Processing Activities (RoPA)

  🏛️ **ODPC Requirements**
  • Registration process and fees
  • Compliance obligations
  • Enforcement and penalties

  🚨 **Breach Management**
  • 72-hour notification rule
  • What counts as a breach
  • Notification to data subjects

  ⚖️ **Data Subject Rights**
  • Access, erasure, portability, objection
  • DSR response timelines (21 days)

  👤 **DPO & Governance**
  • When a DPO is required
  • DPO responsibilities

  📊 **Your Dashboard**
  • "My compliance score"
  • "How to improve score"
  • "My open breaches"
  • "My pending tasks"

  Just ask!


message: 72-hour breach rule
created_at: 2026-05-19 12:22:58
reply:
  🚨 **Data Breach Notification Rules (DPA Section 43)**

  **To ODPC (Office of Data Protection Commissioner):**
  • Must notify within **72 hours** of becoming aware of the breach
  • If notification is delayed, you must explain why
  • Report even if investigation is not yet complete

  **To Affected Data Subjects:**
  • Required if the breach is likely to result in **high risk** to their rights and freedoms
  • Must be done **without undue delay**
  • Must clearly describe the breach and steps taken

  **What to include in your notification:**
  1. Nature of the breach
  2. Categories and approximate number of people affected
  3. Categories and volume of data records affected
  4. Name and contact of your DPO
  5. Likely consequences of the breach
  6. Measures taken or proposed to address it

  ⚠️ **Failure to notify** ODPC can result in enforcement action and fines.

  👉 Use **Breach Workflow** in Soul Guard to manage this process.


message: odpc registration
created_at: 2026-05-19 12:27:58
reply:
  🏛️ **ODPC Registration — Step by Step**

  Under **DPA Section 18**, all data controllers and processors processing personal data in Kenya must register with the ODPC.

  **Steps to register:**

  1️⃣ **Visit** odpc.go.ke and create an account
  2️⃣ **Complete** the online registration form:
     - Organisation details
     - Nature of data processing
     - Categories of personal data processed
     - Security measures in place
     - DPO details (if applicable)
  3️⃣ **Pay** the registration fee (varies by organisation size)
  4️⃣ **Submit** and await approval (typically 2–4 weeks)
  5️⃣ **Receive** your Data Controller/Processor Certificate

  **Annual renewal** is required — Soul Guard's reminders will alert you before expiry.

  ⚠️ **Operating without registration** is an offence under the DPA.

  💡 Soul Guard's **ODPC Registration** service can handle this entire process for you.


message: what is data protection?
created_at: 2026-05-19 12:47:06
reply:
  📋 **What is a DPIA (Data Protection Impact Assessment)?**

  A DPIA is a process to identify and minimise the data protection risks of a project or processing activity.

  **Under Kenya DPA 2019 (Section 41(5)), a DPIA is MANDATORY when processing is:**
  • Likely to result in high risk to individuals
  • Involves large-scale processing of sensitive data
  • Involves systematic monitoring of public areas
  • Uses new technologies
  • Involves automated decision-making or profiling

  **A DPIA must include:**
  1. Description of the processing and its purposes
  2. Assessment of the necessity and proportionality
  3. Assessment of risks to data subjects
  4. Measures to address those risks

  👉 Use Soul Guard's **DPIA Automation** tool to generate one in minutes.


message: tell me about the data protection officer requirements in kenya.
created_at: 2026-05-19 12:48:21
reply:
  👤 **Data Protection Officer (DPO) Requirements (DPA Section 24)**

  You **must appoint a DPO** if your organisation:

  🔴 **Mandatory cases:**
  • Processes personal data on a large scale
  • Carries out systematic monitoring of individuals
  • Processes special categories of data (health, biometrics, financial) at scale
  • Is a public authority or government body

  🟡 **Recommended (even if not mandatory):**
  • Any organisation regularly dealing with sensitive personal data

  **Your DPO's responsibilities:**
  • Advise on DPA compliance obligations
  • Monitor compliance with the DPA
  • Be the point of contact with the ODPC
  • Conduct or oversee DPIAs
  • Train staff on data protection

  **DPO must:**
  • Have expert knowledge of data protection law
  • Be independent — cannot be penalised for doing their job
  • Be accessible to data subjects

  💡 Don't have one? Soul Guard offers **Outsourced DPO services** — a cost-effective solution for SMEs.


message: tell me about data processors.
created_at: 2026-05-19 12:59:54
reply:
  🏢 **Managing Data Processors (DPA Section 38-40)**

  A **data processor** is any third party that processes personal data on your behalf (e.g., cloud providers, payroll services, marketing agencies).

  **Your obligations as a data controller:**

  1️⃣ **Only use processors with sufficient guarantees** — they must demonstrate adequate technical and organisational measures

  2️⃣ **Have a written Data Processing Agreement (DPA/DPA)** covering:
     • Subject matter and duration of processing
     • Nature and purpose of processing
     • Type of personal data and data subjects
     • Your obligations and rights as controller
     • Processor's obligations (security, confidentiality, sub-processor rules)

  3️⃣ **Processors must not sub-contract** without your authorisation

  4️⃣ **Audit your processors** regularly to verify compliance

  5️⃣ **Processors must notify you immediately** of any breach

  ⚠️ **You remain responsible** for your processors' compliance with the DPA.

  👉 Use Soul Guard's **Processor Assessments** module to manage and document all your processors.


message: what is data protection
created_at: 2026-05-19 13:38:56
reply:
  🛡️ **What is Data Protection?**

  Data protection is the practice of **safeguarding personal information** from unauthorised access, use, disclosure, or destruction.

  In Kenya, data protection is governed by the **Data Protection Act, 2019**, which establishes:

  • **7 Key Principles** for processing personal data
  • **Rights for individuals** (data subjects)
  • **Obligations for organisations** (data controllers and processors)
  • **Enforcement by the ODPC** (Office of the Data Protection Commissioner)

  The law applies to **any organisation** that collects or processes personal data in Kenya.

  📖 *Source: ODPC Personal Data Protection Handbook, pp.4–6*


message: tell me about registration fee
created_at: 2026-05-19 13:39:24
reply:
  💰 **Official ODPC Registration Fees**

  **Micro/Small** (1–50 employees, turnover ≤ Sh 5M):
  • Registration: **Sh 4,000** | Renewal: **Sh 2,000**

  **Medium** (51–99 employees, turnover Sh 5M–50M):
  • Registration: **Sh 16,000** | Renewal: **Sh 9,000**

  **Large** (99+ employees, turnover > Sh 50M):
  • Registration: **Sh 40,000** | Renewal: **Sh 25,000**

  **Public Entities** (government functions):
  • Registration: **Sh 4,000** | Renewal: **Sh 2,000**

  **Charities/Religious Entities:**
  • Registration: **Sh 4,000** | Renewal: **Sh 2,000**

  📝 Payment online at **odpc.go.ke**. Certificate valid 2 years. Renew 30 days before expiry.

  📖 *Source: ODPC Personal Data Protection Handbook, p.13*


message: data rights
created_at: 2026-05-19 13:55:58
reply:
  ⚖️ **Data Subject Rights Under Kenya DPA 2019**

  Individuals have these 8 rights:

  **(a) Right to be Informed** — Know how data will be used.
  **(b) Right of Access** — Get a copy of their data (respond within 21 days).
  **(c) Right to Object** — Object to processing.
  **(d) Right to Rectification** — Correct false data.
  **(e) Right to Deletion** — Delete false data.
  **(f) Right to Erasure** — 'Right to be forgotten'.
  **(g) Right to Data Portability** — Get data in machine-readable format.
  **(h) Rights re Automated Decision-Making** — Protection from algorithm-only decisions.

  ⏱️ **Response timeframe: 21 days** (extendable to 2 months for complex requests).

  📖 *Source: ODPC Handbook p.10*


message: so which documents do i need?
created_at: 2026-05-19 18:50:42
reply:
  Good evening, **there**! 👋

  I'm **Patricia**, your Data Protection Assistant for Soul Guard.

  I'm trained on Kenya's **Data Protection Act 2019** and the official **ODPC Personal Data Protection Handbook**.

  Here's what I can help with:

  📋 **Compliance Fundamentals** — 7 principles, DPIAs, lawful basis, RoPA
  🏛️ **ODPC Requirements** — registration fees, process, exemptions
  🚨 **Breach Management** — 72-hour ODPC rule, 48-hour processor rule
  ⚖️ **Data Subject Rights** — access, erasure, portability, 21-day response
  📊 **Your Dashboard** — type **"my score"** for a personalised overview

  What would you like to know?


message: analyse my dashboard
created_at: 2026-05-19 18:51:16
reply:
  Hi there, I'm Patricia — your Data Protection Assistant.

  I couldn't find a specific answer for that in my knowledge base. Here's what I can help with:

  • **"What is data protection?"**
  • **"What is a DPIA?"**
  • **"72-hour breach rule"**
  • **"ODPC registration fees"**
  • **"Data subject rights"**
  • **"Data protection principles"**
  • **"My compliance score"**

  For expert guidance, contact:
  📧 support@soulguard.co.ke
  📞 ODPC: +254 752 896 867


message: i meant my score
created_at: 2026-05-19 18:51:29
reply:
  📊 **CJ Enterprise's Compliance Score: 0% (Not Assessed Risk)**

  Immediate action needed. Complete your DPA Assessment first.

  • Open Breaches: **0**
  • Completed DPIAs: **0**
  • Pending Tasks: **0**


message: my score
created_at: 2026-05-19 18:54:55
reply:
  📊 **CJ Enterprise's Compliance Score: 77% (Medium Risk)**

  You're on the right track. Focus on pending tasks.

  • Open Breaches: **0**
  • Completed DPIAs: **0**
  • Pending Tasks: **0**


message: my score
created_at: 2026-05-19 18:56:40
reply:
  📊 **CJ Enterprise's Compliance Score: 77% (Medium Risk)**

  You're on the right track. Focus on pending tasks.

  • Open Breaches: **0**
  • Completed DPIAs: **1**
  • Pending Tasks: **0**


message: my score
created_at: 2026-05-19 19:51:01
reply:
  📊 **Default Organization's Compliance Score: 0% (Not Assessed Risk)**

  Immediate action needed. Complete your DPA Assessment first.

  • Open Breaches: **0**
  • Completed DPIAs: **0**
  • Pending Tasks: **0**


message: tell me about the registration process.
created_at: 2026-05-20 18:53:12
reply:
  🏛️ **ODPC Registration Process**

  Under **DPA Section 18**, all data controllers and processors must register.

  **Steps:**
  1. Visit **odpc.go.ke** and submit application electronically
  2. Provide organisational details, processing activities, purposes, data categories
  3. Pay registration fee (see fee schedule)
  4. Certificate issued within **14 days** of payment
  5. Certificate valid for **2 years** — renew 30 days before expiry

  **Exemptions:** Organisations with turnover below Sh 5M AND fewer than 10 employees.
  Public entities and non-profits must register regardless of revenue.

  📖 *Source: ODPC Handbook pp.12–13*


message: who are you?
created_at: 2026-05-22 12:33:24
reply:
  🤖 **I'm Patricia — your Kenya DPA 2019 Compliance Assistant!**

  **I can help with:**

  📋 **Fundamentals:**
  • What is data protection?
  • 7 Principles of data protection
  • What is personal data?
  • What is sensitive data?

  🏛️ **ODPC:**
  • Registration process & fees
  • How to complain
  • Penalties & enforcement

  🚨 **Breach:**
  • 72-hour notification rule
  • What counts as a breach

  ⚖️ **Rights:**
  • All 8 data subject rights
  • DSR response timelines

  📊 **Your Dashboard:**
  • "My compliance score"
  • "How to improve score"

  Just ask me anything about data protection!


created_at: 2026-05-22 19:15:34
message:
  do i need help in a odc ip requirements and give me an overview layout of this website that you are in

reply:
[cell repeats an earlier one in this file: 619 characters]


message: tell me about fines and penalties
created_at: 2026-05-22 19:28:28
reply:
  ⚠️ **DPA 2019 Penalties & Enforcement**

  **Criminal offences:**
  • Failure to register — Fine up to **KES 3 million** or 2 years imprisonment
  • Unlawful processing — Fine up to **KES 5 million** or 10 years imprisonment
  • Failure to notify breach — Fine up to **KES 5 million** or 3 years imprisonment
  • Obstruction of ODPC — Fine up to **KES 1 million**

  **ODPC can also:**
  • Issue Enforcement Notices requiring corrective action
  • Issue Penalty Notices with fines
  • Investigations concluded within 90 days

  💡 Prevention is far cheaper than penalties.


message: what is a sensitive data
created_at: 2026-05-22 19:29:43
reply:
  🔴 **What is Sensitive Personal Data?**

  Sensitive data is **very private information** needing extra protection.

  **Examples:**
  • Health status / medical data
  • Biometric data (fingerprints, facial recognition)
  • Ethnicity / racial origin
  • Marital status
  • Genetic data
  • Political opinions
  • Religious beliefs
  • Trade union membership
  • Sexual orientation
  • Criminal convictions
  • Financial information

  ⚠️ A DPIA is almost always required for sensitive data processing.

  📖 *Source: ODPC Handbook pp.7 & 11*


message: what is data protection impact assessment
created_at: 2026-05-22 19:31:14
reply:
  📋 **What is a DPIA (Data Protection Impact Assessment)?**

  A DPIA is a process to identify and minimise data protection risks **before** starting a project.

  **Under DPA Section 41(5), a DPIA is MANDATORY when:**
  • Processing is likely to result in high risk to individuals
  • Large-scale processing of sensitive data
  • Systematic monitoring of public areas
  • Using new technologies
  • Automated decision-making or profiling

  **A DPIA must include:**
  1. Description of processing and purposes
  2. Assessment of necessity and proportionality
  3. Assessment of risks to data subjects
  4. Measures to address those risks

  👉 Use Soul Guard's **DPIA Automation** tool.

  📖 *Source: ODPC Handbook p.11 | DPA Section 41(5)*


message: who created you
created_at: 2026-05-22 19:32:49
reply:
  Hi there! I'm Patricia, your dedicated **Data Protection Assistant**. 🛡️

  I'm specifically trained on Kenya's **Data Protection Act 2019** and the **ODPC Personal Data Protection Handbook**.

  I can help you with:
  • **"What is data protection?"**
  • **"What is a DPIA?"**
  • **"72-hour breach notification rule"**
  • **"ODPC registration fees"**
  • **"Data subject rights"**
  • **"My compliance score"**

  For anything outside data protection, contact support@soulguard.co.ke


message: what is data processing agreement
created_at: 2026-05-22 19:33:34
reply:
  📌 **What is Personal Data? (ODPC Handbook p.7)**

  Personal data is **any information that can identify a natural person**.

  **Common examples:**
  • Name
  • Phone number
  • ID number
  • Location/Address
  • Email address
  • IP address
  • Photos or videos
  • Employment records
  • Financial information

  If you collect **any** of these, the DPA 2019 applies to you.

  📖 *Source: ODPC Personal Data Protection Handbook, pp.7–8*


message: Data rights
created_at: 2026-05-22 19:53:02
reply:
  ⚖️ **Data Subject Rights Under Kenya DPA 2019**

  Every individual whose data you hold has **8 rights** — and you're legally required to honour them.

  **(a) Right to be Informed**
     People must know what data you collect, why, and how — usually through a Privacy Notice.

  **(b) Right of Access**
     Anyone can request a copy of their personal data. You must respond within **21 days**.

  **(c) Right to Object**
     People can say 'stop processing my data' — especially for direct marketing. You must comply.

  **(d) Right to Rectification**
     If their data is wrong, they can ask you to correct it. You must do so promptly.

  **(e) Right to Deletion**
     They can request deletion of false or unlawfully processed data.

  **(f) Right to Erasure ('Right to be Forgotten')**
     Broader than deletion — they can ask you to erase data that's no longer necessary.

  **(g) Right to Data Portability**
     They can request their data in a structured, machine-readable format (e.g. CSV) to take elsewhere.

  **(h) Rights re Automated Decision-Making**
     Protection from decisions made purely by algorithms that significantly affect them.

  ⏱️ **Response deadline: 21 days** (extendable to 2 months for complex requests — but you must inform them).

  📖 *Source: ODPC Handbook p.10*


message: ODPC fees
created_at: 2026-05-22 19:53:12
reply:
  💰 **Official ODPC Registration Fees**

  Fees are set based on your organisation size. Here's the breakdown:

  **Micro / Small** *(1–50 employees, annual turnover up to Sh. 5 million)*
  Registration: **Sh. 4,000** | Renewal: **Sh. 2,000**

  **Medium** *(51–99 employees, turnover Sh. 5M–50M)*
  Registration: **Sh. 16,000** | Renewal: **Sh. 9,000**

  **Large** *(100+ employees, turnover above Sh. 50 million)*
  Registration: **Sh. 40,000** | Renewal: **Sh. 25,000**

  **Public Entities** *(government bodies & agencies)*
  Registration: **Sh. 4,000** | Renewal: **Sh. 2,000**

  **Charities, Religious Organisations & NGOs**
  Registration: **Sh. 4,000** | Renewal: **Sh. 2,000**

  📝 **Practical notes:**
  • Pay online at **odpc.go.ke**
  • Certificate is valid for **2 years**
  • Renew at least **30 days before expiry** to avoid a lapse
  • Late renewals may attract penalties

  📖 *Source: ODPC Personal Data Protection Handbook, p.13*


message: Hello.
created_at: 2026-05-22 20:04:30
reply:
  Hello, **there**! 👋

  Good to see you. I'm here whenever you need help with Kenya's Data Protection Act 2019.

  You can ask me things like:
  • **"What is a DPIA?"**
  • **"72-hour breach rule"**
  • **"ODPC registration fees"**
  • **"Where is the ODPC?"**
  • **"Data subject rights"**
  • **"My compliance score"**

  What's on your mind today?


message: Wazo DPC located location.
created_at: 2026-05-22 20:05:46
reply:
  📍 **ODPC Office — Location & Contacts**

  The Office of the Data Protection Commissioner is based in **Nairobi, Kenya**.

  **Physical Address:**
  12th Floor, Britam Tower
  Hospital Road, Upper Hill
  Nairobi, Kenya

  **Postal Address:**
  P.O. Box 30274 – 00100
  Nairobi, Kenya

  **Phone:** +254 752 896 867

  **Email:** info@odpc.go.ke

  **Website:** odpc.go.ke

  🕐 **Office Hours:** Monday – Friday, 8:00 AM – 5:00 PM

  **Getting there:** Britam Tower is a prominent skyscraper on Hospital Road in Upper Hill — accessible via Nairobi CBD, and near the Nairobi Hospital roundabout. Ample parking is available.

  For complaints and registration, the ODPC also accepts submissions via their **online portal** at odpc.go.ke — so you don't always need to visit in person.


message: To get an X-ray or making a razor.
created_at: 2026-05-22 20:06:28
reply:
  Hmm, I want to make sure I give you the right answer on that, there, and I'm not confident I have enough information to do it justice.

  **What I can do:**

  • Connect you with a **live compliance advisor** on the Soul Guard team
  • Or try rephrasing — sometimes a different angle helps me find it

  **Popular questions I know well:**
  • **"What is a DPIA?"**
  • **"72-hour breach rule"**
  • **"ODPC registration fees"**
  • **"Data subject rights"**
  • **"Where is the ODPC office?"**
  • **"What is personal data?"**

  **Reach a real person:**
  📧 support@soulguard.co.ke
  📞 ODPC Helpline: +254 752 896 867


created_at: 2026-05-22 20:06:41
message:
  I want to make sure I give you the right answer on that there, and I'm not confident I have enough information to do it justice.

reply:
  📌 **What is Personal Data?**

  Personal data is any piece of information that can identify a living individual — either on its own, or when combined with other information you hold.

  **If you collect any of these, the DPA 2019 applies to you:**
  • Full name
  • Phone number or mobile number
  • National ID number or passport number
  • Physical or postal address
  • Email address
  • IP address or device identifiers
  • Photos or video footage (e.g. CCTV)
  • Location / GPS data
  • Employment records
  • Financial information or bank account details

  **Remember:** even a combination of seemingly harmless data points — like a job title plus employer plus town — can be enough to identify someone and therefore counts as personal data.

  📖 *Source: ODPC Personal Data Protection Handbook, pp.7–8*


message: Once a humongous.
created_at: 2026-05-22 20:10:12
reply:
  I want to be straight with you, there — I'm not sure I have reliable information on that specific question.

  **What I can do:**

  • Connect you with a **live compliance advisor** on the Soul Guard team
  • Or try rephrasing — sometimes a different angle helps me find it

  **Popular questions I know well:**
  • **"What is a DPIA?"**
  • **"72-hour breach rule"**
  • **"ODPC registration fees"**
  • **"Data subject rights"**
  • **"Where is the ODPC office?"**
  • **"What is personal data?"**

  **Reach a real person:**
  📧 support@soulguard.co.ke
  📞 ODPC Helpline: +254 752 896 867


message: Handsome.
created_at: 2026-05-22 20:10:15
reply:
  That's an interesting one, there — I don't have a confident answer for that in my knowledge base right now.

  **What I can do:**

  • Connect you with a **live compliance advisor** on the Soul Guard team
  • Or try rephrasing — sometimes a different angle helps me find it

  **Popular questions I know well:**
  • **"What is a DPIA?"**
  • **"72-hour breach rule"**
  • **"ODPC registration fees"**
  • **"Data subject rights"**
  • **"Where is the ODPC office?"**
  • **"What is personal data?"**

  **Reach a real person:**
  📧 support@soulguard.co.ke
  📞 ODPC Helpline: +254 752 896 867


message: Who are you?
created_at: 2026-05-22 20:54:17
reply:
  I'm **Patricia** — Soul Guard's Data Protection Compliance Assistant. 🛡️

  I'm not a person, but I'm trained specifically on Kenya's **Data Protection Act 2019** and the official **ODPC Personal Data Protection Handbook**, so I know this stuff inside out.

  If I ever hit a question I can't answer, I'll be honest with you and connect you with a real compliance expert on the Soul Guard team.

  So — what would you like to know?


message: Who created you?
created_at: 2026-05-22 20:55:06
reply:
  Ha! That's a bit outside my lane, there. 😄

  I'm Patricia — I live and breathe Kenya's **Data Protection Act 2019**. Things like football scores and weather are way above my pay grade!

  But ask me anything about data protection and I'm all yours:

  • **"What is a DPIA?"**
  • **"72-hour breach notification rule"**
  • **"ODPC registration fees"**
  • **"Data subject rights"**
  • **"Where is the ODPC office?"**

  For anything else, feel free to reach the team at **support@soulguard.co.ke**


message: Who created Soul God?
created_at: 2026-05-22 20:57:57
reply:
  🛡️ **About Soul Guard**

  Soul Guard is a **Kenya DPA 2019 compliance platform** designed to make data protection manageable — especially for organisations that don't have a large legal or compliance department.

  **What Soul Guard offers:**
  • 📊 **Compliance Dashboards** — track your compliance score in real time
  • 📋 **DPIA Automation** — guided DPIA templates that meet ODPC standards
  • 🚨 **Breach Management** — log, track and report data breaches with automatic 72-hour timers
  • 📁 **RoPA Builder** — document all your data flows in one place
  • ⚖️ **DSR Management** — handle data subject requests and track the 21-day deadline
  • 👤 **Outsourced DPO** — expert DPO coverage without a full-time hire
  • 📚 **Staff Training** — data protection awareness for your team

  **Get in touch:**
  📧 support@soulguard.co.ke

  I'm Patricia — part of the Soul Guard family. Let me know what else I can help with!


message: So you don't know.
created_at: 2026-05-22 21:00:14
reply:
  Happy to give you a rundown! Here's what I know well:

  📋 **Fundamentals**
  • What is data protection and the DPA 2019?
  • The 7 principles of data protection
  • What is personal data?
  • What is sensitive data?

  🏛️ **ODPC**
  • Registration process and fees
  • ODPC location and contacts
  • How to lodge a complaint
  • Penalties and enforcement

  🚨 **Breach Management**
  • 72-hour notification rule
  • What counts as a breach?

  ⚖️ **Rights & Obligations**
  • All 8 data subject rights
  • Lawful basis for processing
  • Consent requirements
  • Privacy notices

  📁 **Documentation**
  • RoPA (Record of Processing Activities)
  • DPIAs
  • Data retention policies

  🌍 **Special Topics**
  • Cross-border transfers
  • Children's data
  • Employee / HR data
  • Direct marketing rules

  📊 **Your Dashboard**
  • 'My compliance score'
  • 'How do I improve my score?'

  Just ask — I'll do my best to help!


message: Registration process.
created_at: 2026-05-23 05:21:35
reply:
  🏛️ **ODPC Registration — Who, How and What to Expect**

  **Who must register?** Under DPA Section 18, all data controllers and data processors operating in Kenya must register — unless you qualify for an exemption (see below).

  **Step-by-step process:**
  1. Go to **odpc.go.ke** and create an account
  2. Fill in your organisation's details, data processing activities, purposes, and categories of data
  3. Pay the applicable registration fee online
  4. Your certificate is issued within **14 days** of payment
  5. Certificate is valid for **2 years** — set a reminder to renew 30 days before expiry

  **Exemptions:**
  You do not need to register if your organisation has:
  • Annual turnover below **Sh. 5 million**, AND
  • Fewer than **10 employees**

  ⚠️ Note: Public bodies and non-profits must register **regardless** of size or revenue.

  📖 *Source: ODPC Handbook pp.12–13 | DPA Section 18*


message: What is data data controller with a data controller?
created_at: 2026-05-23 09:45:44
reply:
  🧩 **Data Controller vs Data Processor — What's the Difference?**

  These are two distinct roles, and knowing which one you are determines your legal obligations.

  **Data Controller**
  The entity that *decides* why and how personal data is processed.
  Example: A hospital that collects patient records is the controller — it decides the purpose (patient care) and the means (their hospital system).

  **Data Processor**
  The entity that *processes* data on behalf of the controller.
  Example: A cloud storage company or payroll outsourcing firm processes your staff data on your instruction — they're the processor.

  **Key practical differences:**
  • Controllers carry the *primary* compliance responsibility
  • Processors must follow the controller's instructions and have a written contract
  • Processors must report breaches to controllers within **48 hours**
  • Both must register with the ODPC

  💡 Many organisations are **both** — controller for their customers' data, processor for a client's data.

  📖 *Source: DPA 2019, Sections 2 & 19*


message: fines and penalty
created_at: 2026-05-25 07:09:38
reply:
  ⚠️ **DPA 2019 — Penalties for Non-Compliance**

  The penalties are serious. This is not a law the ODPC treats lightly.

  **Criminal Offences:**
  • Failure to register with ODPC → Up to **Sh. 3 million** or 2 years in prison
  • Unlawful processing of personal data → Up to **Sh. 5 million** or 10 years in prison
  • Failure to notify a breach → Up to **Sh. 5 million** or 3 years in prison
  • Obstruction of ODPC investigation → Up to **Sh. 1 million**

  **Regulatory Actions:**
  • **Enforcement Notice** — ODPC orders you to take or stop an action
  • **Penalty Notice** — formal financial penalty
  • **Information Notice** — ODPC demands information from you
  • **Assessment Notice** — ODPC audits your data practices

  🕐 ODPC investigations are typically concluded within **90 days**.

  💡 Prevention is far cheaper. A Soul Guard compliance package costs a fraction of even the smallest fine.


message: my score
created_at: 2026-05-25 07:10:20
reply:
  🟡 **Wasafi Enteprise: 62% Compliance (Medium Risk)**

  You're on the right track. A few more wins on those pending tasks and you'll be in the green.

  **Quick snapshot:**
  • 🚨 Open Breaches: **0**
  • 📋 Completed DPIAs: **1**
  • ✅ Pending Tasks: **1**

  Want tips on improving your score? Just ask — **"how do I improve my score?"**


message: what is data protection
created_at: 2026-06-01 10:33:10
reply:
  🛡️ **What is Data Protection?**

  Simply put, data protection is about **treating people's personal information with respect**. It means collecting only what you need, keeping it safe, being transparent about how you use it, and giving people control over their own information.

  In Kenya, this is governed by the **Data Protection Act 2019** — a law that came into force in November 2019 and is enforced by the **Office of the Data Protection Commissioner (ODPC)**.

  **The law covers:**
  • How personal data must be collected, stored and used
  • Rights individuals have over their data
  • Obligations for businesses and organisations
  • Penalties for non-compliance

  If your organisation touches any personal information — names, phone numbers, emails, health records — this law applies to you.

  📖 *Source: ODPC Personal Data Protection Handbook, pp.4–6*


message: tell us about 72 hours Bridge Road
created_at: 2026-06-01 10:47:02
reply:
  🚨 **Data Breach Notification (DPA Section 43)**

  A data breach is any incident where personal data is accidentally or unlawfully **accessed, lost, altered, disclosed or destroyed** — think a hacked database, a misdirected email, a stolen laptop, or even an employee sharing data without authorisation.

  **When it happens, the clock starts immediately.**

  ⏱️ **72 hours** — Notify the **ODPC** from the moment you become aware
  ⏱️ **48 hours** — If you're a **processor**, you must alert your controller within 48 hours

  **If individuals are at high risk, notify them too** — without undue delay.

  **Your notification to the ODPC must include:**
  1. The nature of the breach (what happened)
  2. Categories and approximate number of individuals affected
  3. Volume and type of data involved
  4. Your DPO's contact details
  5. Likely consequences of the breach
  6. Steps you've already taken or plan to take

  ⚠️ Failing to notify is itself an offence — up to **Sh. 5 million** fine or 3 years' imprisonment.

  📖 *Source: ODPC Handbook p.11 | DPA Section 43*


message: What is DPIA?
created_at: 2026-06-02 09:23:32
reply:
  📋 **What is a DPIA?**

  DPIA stands for **Data Protection Impact Assessment**. Think of it as a risk assessment you do *before* starting a project that involves personal data — so you can spot problems early and fix them, rather than scrambling after the fact.

  **Under DPA Section 41(5), a DPIA is MANDATORY when:**
  • The processing is likely to result in high risk to individuals
  • You're processing sensitive data on a large scale (health records, biometrics, etc.)
  • You're monitoring people in public spaces (CCTV, tracking apps)
  • You're using new technology that could impact privacy
  • You're making automated decisions that significantly affect people

  **Your DPIA must cover:**
  1. What data you're collecting and why
  2. Whether the processing is necessary and proportionate
  3. What risks exist for the people whose data you hold
  4. What measures you'll put in place to reduce those risks

  💡 **Pro tip:** Use Soul Guard's **DPIA Automation** tool — it walks you through the whole process step by step.

  📖 *Source: ODPC Handbook p.11 | DPA Section 41(5)*


message: Maybe this afternoon about the history of deter potential in Kenya.
created_at: 2026-06-02 16:32:55
reply:
  🌍 **Transferring Personal Data Outside Kenya**

  If you're sending personal data to a server, partner or processor in another country, you need to ensure the data remains protected — it doesn't simply leave your responsibilities at the border.

  **Under DPA Section 48, you may transfer data outside Kenya if:**

  • The destination country has **adequate data protection laws** recognised by the ODPC, OR
  • You have **appropriate safeguards** in place, such as:
    — Standard contractual clauses with the recipient
    — Binding corporate rules (for multinationals)
    — The recipient has demonstrably equivalent protections
  • The individual has given **explicit consent** to the cross-border transfer
  • The transfer is necessary for a contract with the individual

  **Common examples where this matters:**
  • Using cloud services hosted overseas (AWS, Google Cloud, Azure)
  • Sharing data with foreign parent companies or subsidiaries
  • Sending HR data to an overseas payroll provider

  💡 Always document cross-border transfers in your RoPA.

  📖 *Source: DPA 2019, Section 48*


message: RoPA
created_at: 2026-06-02 16:57:30
reply:
  📁 **Record of Processing Activities (RoPA)**

  A RoPA is your **master register of everything you do with personal data**. It's the foundation of good data governance — if you don't know what data you have and what you're doing with it, you can't protect it.

  **Your RoPA should document:**
  • Name and contact details of the controller and DPO
  • Purposes of each processing activity
  • Categories of data subjects and personal data involved
  • Who the data is shared with (third parties)
  • Cross-border transfers and safeguards
  • Retention periods
  • Security measures in place

  **Is it mandatory?** Under DPA Section 29, yes — for most organisations. You must be able to produce it if the ODPC asks.

  💡 Soul Guard's dashboard helps you build and maintain your RoPA automatically.

  📖 *Source: DPA 2019, Section 29*


# chatbot_knowledge

category: General
topic: What is data protection
keywords: ["data","protection","meaning","definition","explain","overview","about","privacy","law"]
created_at: 2026-05-22 20:15:33
phrases:
  ["what is data protection","what does data protection mean","define data protection","data protection definition","explain data protection","tell me about data protection","about data protection","what is the dpa","what is dpa 2019"]

answer:
[cell repeats an earlier one in this file: 850 characters]


category: Principles
topic: The 7 data protection principles
created_at: 2026-05-22 20:15:33
keywords:
  ["principles","principle","lawfulness","fairness","transparency","purpose","minimisation","accuracy","storage","accountability","integrity","confidentiality","seven","7"]

phrases:
  ["data protection principles","7 principles","seven principles","key principles","principles of data protection","what are the principles","tell me the principles","list the principles"]

answer:
  📜 **The 7 Principles of Data Protection (DPA 2019, Section 25)**

  Think of these as the golden rules — every data processing activity must follow all seven.

  **1. Lawfulness, Fairness & Transparency**
     Process data only with a valid legal reason, be honest about it, and don't use it in ways people wouldn't expect.

  **2. Purpose Limitation**
     Collect data for a clear, specific reason — and don't use it for something different later.

  **3. Data Minimisation**
     Only collect what you actually need. If you don't need the date of birth, don't ask for it.

  **4. Accuracy**
     Keep records up to date. Wrong data about someone can cause real harm.

  **5. Storage Limitation**
     Don't hold onto data forever. Set retention periods and delete when no longer needed.

  **6. Integrity & Confidentiality**
     Protect data from breaches, hacking, accidental loss, or unauthorised access.

  **7. Accountability**
     You're responsible for compliance — and you must be able to *demonstrate* it, not just claim it.

  📖 *Source: ODPC Personal Data Protection Handbook, p.6*


category: DPIA
topic: What is a DPIA
keywords: ["dpia","impact","assessment","privacy","risk"]
created_at: 2026-05-22 20:15:33
phrases:
  ["what is a dpia","what is dpia","dpia meaning","dpia stands for","data protection impact assessment","explain dpia","tell me about dpia","when do i need a dpia","when is dpia required","is dpia mandatory"]

answer:
  📋 **What is a DPIA?**

  DPIA stands for **Data Protection Impact Assessment**. Think of it as a risk assessment you do *before* starting a project that involves personal data — so you can spot problems early and fix them, rather than scrambling after the fact.

  **Under DPA Section 41(5), a DPIA is MANDATORY when:**
  • The processing is likely to result in high risk to individuals
  • You're processing sensitive data on a large scale (health records, biometrics, etc.)
  • You're monitoring people in public spaces (CCTV, tracking apps)
  • You're using new technology that could impact privacy
  • You're making automated decisions that significantly affect people

  **Your DPIA must cover:**
  1. What data you're collecting and why
  2. Whether the processing is necessary and proportionate
  3. What risks exist for the people whose data you hold
  4. What measures you'll put in place to reduce those risks

  💡 **Pro tip:** Use Soul Guard's **DPIA Automation** tool — it walks you through the whole process step by step.

  📖 *Source: ODPC Handbook p.11 | DPA Section 41(5)*


category: Breach
topic: 72-hour breach notification rule
created_at: 2026-05-22 20:15:33
keywords:
  ["breach","notification","72","hours","report","notify","odpc","incident","48","rule","violation","hack","leaked","data loss"]

phrases:
  ["72 hour rule","breach notification","notify odpc","report breach","data breach rule","breach timeline","48 hours","when to report breach","how to report breach","what is a data breach","what counts as a breach","do i need to report"]

answer:
[cell repeats an earlier one in this file: 1046 characters]


category: ODPC
topic: ODPC registration fees
created_at: 2026-05-22 20:15:33
keywords:
  ["fee","cost","price","pay","registration","odpc","charges","micro","small","medium","large","renewal","how much"]

phrases:
  ["registration fee","how much does it cost","odpc fee","cost of registration","registration charges","how much to register","renewal fee","odpc registration fee","what are the fees","how much is registration","fee schedule"]

answer:
[cell repeats an earlier one in this file: 914 characters]


category: Data Subject Rights
topic: Data subject rights
created_at: 2026-05-22 20:15:33
keywords:
  ["rights","subject","access","erasure","delete","portability","object","rectify","correction","individual","person","citizen"]

phrases:
  ["data subject rights","rights of individuals","what rights do people have","right to access","right to erasure","right to delete","what are my rights","data subject rights kenya","rights under dpa","individual rights","8 rights","eight rights"]

answer:
[cell repeats an earlier one in this file: 1265 characters]


category: Personal Data
topic: What is personal data
created_at: 2026-05-22 20:15:33
keywords:
  ["personal","data","definition","identify","identifiable","name","phone","location","examples","information"]

phrases:
  ["what is personal data","define personal data","personal data means","what counts as personal data","examples of personal data","what is personal information","personal data definition","does this count as personal data","is this personal data"]

answer:
[cell repeats an earlier one in this file: 782 characters]


category: Sensitive Data
topic: What is sensitive personal data
created_at: 2026-05-22 20:15:33
keywords:
  ["sensitive","special","health","biometric","racial","ethnic","religion","political","criminal","financial","category"]

phrases:
  ["what is sensitive data","sensitive personal data","special categories","what is sensitive personal data","examples of sensitive data","sensitive data definition","special category data"]

answer:
  🔴 **Sensitive Personal Data — Handle With Extra Care**

  Some data is so private that the law gives it extra protection. Processing this type of data without a very strong lawful basis can be a serious offence.

  **Sensitive categories include:**
  • Health status and medical history
  • Biometric data (fingerprints, facial scans, retina data)
  • Ethnic or racial origin
  • Marital status
  • Genetic data
  • Political opinions or affiliations
  • Religious or philosophical beliefs
  • Trade union membership
  • Sexual orientation or gender identity
  • Criminal records or convictions
  • Financial information

  ⚠️ **Key rule:** Always conduct a **DPIA** before processing sensitive data at any meaningful scale. Explicit **consent** is usually required — or another very specific lawful basis.

  📖 *Source: ODPC Handbook pp.7 & 11*


category: ODPC
topic: ODPC registration process
keywords: ["odpc","register","registration","certificate","application","process","how","steps","apply"]
created_at: 2026-05-22 20:15:33
phrases:
  ["how to register","odpc registration","register with odpc","registration process","how do i register","registration certificate","odpc registration process","how to register with odpc","steps to register","do i need to register","who needs to register"]

answer:
  🏛️ **ODPC Registration — Who, How and What to Expect**

  **Who must register?** Under DPA Section 18, all data controllers and data processors operating in Kenya must register — unless you qualify for an exemption (see below).

  **Step-by-step process:**
  1. Go to **odpc.go.ke** and create an account
  2. Fill in your organisation's details, data processing activities, purposes, and categories of data
  3. Pay the applicable registration fee online
  4. Your certificate is issued within **14 days** of payment
  5. Certificate is valid for **2 years** — set a reminder to renew 30 days before expiry

  **Exemptions:**
  You do not need to register if your organisation has:
  • Annual turnover below **Sh. 5 million**, AND
  • Fewer than **10 employees**

  ⚠️ Note: Public bodies and non-profits must register **regardless** of size or revenue.

  📖 *Source: ODPC Handbook pp.12–13 | DPA Section 18*


category: ODPC
topic: ODPC office location and contacts
created_at: 2026-05-22 20:15:33
keywords:
  ["odpc","office","location","address","where","contact","phone","email","nairobi","britam","upperhill","visit","find","directions","headquarters"]

phrases:
  ["where is the odpc","odpc location","odpc address","odpc office","odpc contacts","how to contact odpc","odpc phone number","odpc email","where is odpc office","odpc nairobi","visit odpc","find odpc","odpc headquarters","odpc physical address"]

answer:
[cell repeats an earlier one in this file: 752 characters]


category: Definitions
topic: Data controller vs data processor
created_at: 2026-05-22 20:15:33
keywords:
  ["controller","processor","difference","data controller","data processor","role","responsible","who","which"]

phrases:
  ["what is a data controller","what is a data processor","data controller vs processor","difference between controller and processor","controller or processor","am i a controller or processor","who is the controller","who is the processor"]

answer:
  🧩 **Data Controller vs Data Processor — What's the Difference?**

  These are two distinct roles, and knowing which one you are determines your legal obligations.

  **Data Controller**
  The entity that *decides* why and how personal data is processed.
  Example: A hospital that collects patient records is the controller — it decides the purpose (patient care) and the means (their hospital system).

  **Data Processor**
  The entity that *processes* data on behalf of the controller.
  Example: A cloud storage company or payroll outsourcing firm processes your staff data on your instruction — they're the processor.

  **Key practical differences:**
  • Controllers carry the *primary* compliance responsibility
  • Processors must follow the controller's instructions and have a written contract
  • Processors must report breaches to controllers within **48 hours**
  • Both must register with the ODPC

  💡 Many organisations are **both** — controller for their customers' data, processor for a client's data.

  📖 *Source: DPA 2019, Sections 2 & 19*


category: Lawful Basis
topic: Consent as lawful basis
keywords: ["consent","permission","agree","opt","lawful","basis","valid","withdraw"]
created_at: 2026-05-22 20:15:33
phrases:
  ["what is consent","lawful basis","how to get consent","valid consent","withdraw consent","basis for processing","legal basis","can i withdraw consent","how do i get valid consent","what makes consent valid"]

answer:
  ✅ **Consent Under the Kenya DPA 2019**

  Consent is one of several **lawful bases** for processing personal data — but only if it meets specific standards. Vague or assumed consent doesn't count.

  **For consent to be valid, it must be:**
  • **Freely given** — no penalty for refusing
  • **Specific** — tied to a clear, stated purpose
  • **Informed** — the person must understand what they're agreeing to
  • **Unambiguous** — a clear 'yes', not a pre-ticked box
  • **Withdrawable** — as easy to withdraw as it was to give

  **Other lawful bases (you don't always need consent):**
  • Contractual necessity (processing needed to fulfil a contract)
  • Legal obligation (the law requires you to process it)
  • Vital interests (protecting someone's life)
  • Public interest
  • Legitimate interests of the controller (must be balanced against individual rights)

  ⚠️ **Children:** Parental consent is required for anyone under 18.

  📖 *Source: DPA 2019, Section 30 & ODPC Handbook p.9*


category: Documentation
topic: Privacy notice requirements
keywords: ["privacy","notice","policy","statement","transparency","inform","disclosure","what","include"]
created_at: 2026-05-22 20:15:33
phrases:
  ["what is a privacy notice","privacy policy","privacy statement","do i need a privacy notice","privacy notice requirements","what should be in a privacy policy","privacy notice kenya","data privacy policy","how to write a privacy notice"]

answer:
  📄 **Privacy Notice — What It Is and What It Must Include**

  A privacy notice (sometimes called a privacy policy) is how you fulfil your **transparency obligation** — telling people how you collect and use their data before you do it.

  **Under DPA Section 26, you must tell people:**
  1. Your identity and contact details (including your DPO if you have one)
  2. What data you're collecting
  3. Why you're collecting it (the purpose)
  4. Your lawful basis for processing
  5. Who you'll share it with
  6. How long you'll keep it
  7. Their rights (access, erasure, portability, etc.)
  8. Whether data will be sent outside Kenya
  9. Whether automated decision-making is involved

  **Where to put it:**
  • On your website (required by law if you have one)
  • In sign-up forms and contracts
  • At the point of collection (e.g. on a paper form)

  💡 Keep it in plain language — if your customers can't understand it, that's a red flag.

  📖 *Source: DPA 2019, Section 26*


category: Documentation
topic: Record of Processing Activities (RoPA)
created_at: 2026-05-22 20:15:33
keywords:
  ["ropa","record","processing","activities","register","documentation","inventory","data map","data flows"]

phrases:
  ["what is a ropa","record of processing activities","data processing record","do i need a ropa","what is ropa","processing register","data inventory","data flows","data mapping","ropa requirement"]

answer:
[cell repeats an earlier one in this file: 810 characters]


category: Best Practice
topic: Data retention periods
keywords: ["retention","keep","how long","storage","delete","period","dispose","archive","years"]
created_at: 2026-05-22 20:15:33
phrases:
  ["how long can i keep data","data retention","retention period","when should i delete data","how long to store data","data storage limit","retention policy","data retention policy","how long do i keep records"]

answer:
  🗃️ **Data Retention — How Long Can You Keep Personal Data?**

  The short answer: **only as long as you genuinely need it** for the purpose you collected it for. This flows from the **Storage Limitation Principle** (Principle 5).

  **The DPA doesn't set fixed retention periods for all data types**, but expects you to:

  1. **Define retention periods** for each category of data you hold
  2. **Document these** in your RoPA and privacy notices
  3. **Review and delete** data regularly — don't just keep it indefinitely 'just in case'
  4. **Comply with any sector-specific rules** (e.g. Kenya Revenue Authority requires tax records for 5+ years; employment records typically kept for 6 years post-employment)

  **Practical retention guidelines:**
  • Customer records: typically 7 years after last transaction
  • Job application data (unsuccessful): 6–12 months
  • CCTV footage: 30 days (unless needed for an investigation)
  • Financial records: as required by law (usually 5–7 years)

  ⚠️ Keeping data longer than needed without justification can attract ODPC enforcement action.


category: Cross-Border
topic: Cross-border data transfers
created_at: 2026-05-22 20:15:33
keywords:
  ["cross","border","transfer","outside","kenya","international","abroad","foreign","country","safeguards"]

phrases:
  ["cross border transfer","transfer data outside kenya","send data abroad","international transfer","transfer personal data","can i transfer data outside kenya","foreign data transfer","transferring data","cross border data transfer"]

answer:
  🌍 **Transferring Personal Data Outside Kenya**

  If you're sending personal data to a server, partner or processor in another country, you need to ensure the data remains protected — it doesn't simply leave your responsibilities at the border.

  **Under DPA Section 48, you may transfer data outside Kenya if:**

  • The destination country has **adequate data protection laws** recognised by the ODPC, OR
  • You have **appropriate safeguards** in place, such as:
    — Standard contractual clauses with the recipient
    — Binding corporate rules (for multinationals)
    — The recipient has demonstrably equivalent protections
  • The individual has given **explicit consent** to the cross-border transfer
  • The transfer is necessary for a contract with the individual

  **Common examples where this matters:**
  • Using cloud services hosted overseas (AWS, Google Cloud, Azure)
  • Sharing data with foreign parent companies or subsidiaries
  • Sending HR data to an overseas payroll provider

  💡 Always document cross-border transfers in your RoPA.

  📖 *Source: DPA 2019, Section 48*


category: DPO
topic: DPO requirements
created_at: 2026-05-22 20:15:33
keywords:
  ["dpo","data protection officer","appoint","need","require","officer","mandatory","hire","outsource"]

phrases:
  ["do i need a dpo","dpo required","data protection officer","appoint a dpo","when do i need dpo","dpo requirement","is dpo mandatory","what is a dpo","dpo role","dpo responsibilities","hire a dpo"]

answer:
  👤 **Do You Need a Data Protection Officer (DPO)?**

  The ODPC Handbook is clear: a DPO is **not mandatory for everyone**, but is strongly recommended — and in some cases it's a practical necessity.

  **You should seriously consider appointing a DPO if you:**
  • Process personal data on a large scale as part of your core business
  • Carry out systematic or regular monitoring of individuals
  • Handle sensitive/special category data at scale
  • Are a public authority or government body

  **What a DPO does:**
  • Advises on DPA compliance obligations
  • Monitors internal compliance
  • Acts as the contact point for the ODPC
  • Leads on DPIAs and privacy-by-design
  • Trains staff on data protection
  • Handles data subject requests

  **Can't afford a full-time DPO?** That's common — and Soul Guard offers an **Outsourced DPO service** where you get expert DPO coverage without the full-time cost.

  📧 Reach out: support@soulguard.co.ke

  📖 *Source: ODPC Handbook p.13*


category: Penalties
topic: DPA fines and penalties
created_at: 2026-05-22 20:15:33
keywords:
  ["fine","penalty","punishment","sanction","enforcement","offence","violation","jail","prison","consequences","non compliance","noncompliance"]

phrases:
  ["dpa fines","what are the penalties","consequences of non compliance","odpc fines","penalty for breach","what happens if i dont comply","penalties for non compliance","dpa penalties","consequences of violating","fine for not registering"]

answer:
  ⚠️ **DPA 2019 — Penalties for Non-Compliance**

  The penalties are serious. This is not a law the ODPC treats lightly.

  **Criminal Offences:**
  • Failure to register with ODPC → Up to **Sh. 3 million** or 2 years in prison
  • Unlawful processing of personal data → Up to **Sh. 5 million** or 10 years in prison
  • Failure to notify a breach → Up to **Sh. 5 million** or 3 years in prison
  • Obstruction of ODPC investigation → Up to **Sh. 1 million**

  **Regulatory Actions:**
  • **Enforcement Notice** — ODPC orders you to take or stop an action
  • **Penalty Notice** — formal financial penalty
  • **Information Notice** — ODPC demands information from you
  • **Assessment Notice** — ODPC audits your data practices

  🕐 ODPC investigations are typically concluded within **90 days**.

  💡 Prevention is far cheaper. A Soul Guard compliance package costs a fraction of even the smallest fine.


category: Complaints
topic: How to complain to ODPC
keywords: ["complaint","lodge","report","complain","odpc","dissatisfied","violation","file","submit"]
created_at: 2026-05-22 20:15:33
phrases:
  ["how to complain","lodge a complaint","file a complaint","report to odpc","complaint process","how do i complain","make a complaint to odpc","submit a complaint","complain to odpc"]

answer:
  📝 **How to Lodge a Complaint with the ODPC**

  If you believe your data protection rights have been violated, you have the right to complain.

  **Who can lodge a complaint?**
  • The affected person (data subject) directly
  • Someone acting on their behalf with written authority
  • Anonymous complaints are also accepted and investigated

  **How to submit:**
  • **Online:** odpc.go.ke (preferred — fastest route)
  • **In person or by post:** 12th Floor, Britam Tower, Hospital Road, Upper Hill, Nairobi

  **What to include in your complaint:**
  • Your full name, ID number and contact details
  • Full details of the organisation you're complaining about
  • Date(s) of the alleged violation
  • Clear description of what happened
  • Supporting documents or evidence

  **What happens next:**
  • ODPC acknowledges your complaint within **7 days**
  • Investigation concluded within **90 days**

  📖 *Source: ODPC Handbook pp.14–15*


category: Special Topics
topic: Children's data and parental consent
keywords: ["children","child","minor","parental","consent","under 18","below 18","young","kids","youth"]
created_at: 2026-05-22 20:15:33
phrases:
  ["children's data","child data","minor data","parental consent","data of children","processing children data","under 18 data","collecting data from children","children consent","youth data"]

answer:
  👶 **Processing Data About Children**

  The Kenya DPA 2019 gives children's data additional protection. If your service or product could be used by anyone under 18, pay close attention.

  **Key rules:**
  • You must obtain **parental or guardian consent** before collecting data from a child
  • The consent must be **verifiable** — you need a reasonable way to confirm the person giving consent is actually a parent/guardian
  • Consent given by a child alone is generally **not sufficient**

  **Best practices:**
  • Collect the minimum amount of data necessary — apply strict data minimisation
  • Use clear, age-appropriate language in your privacy notices
  • Never use children's data for direct marketing
  • Carry out a DPIA if your service is specifically directed at children

  ⚠️ Processing a child's sensitive data without proper consent carries serious penalties.

  📖 *Source: DPA 2019, Section 32*


category: Marketing
topic: Direct marketing and opt-out
keywords: ["marketing","email","sms","newsletter","opt","unsubscribe","spam","promotional","direct","bulk"]
created_at: 2026-05-22 20:15:33
phrases:
  ["direct marketing","email marketing","sms marketing","opt out","unsubscribe","can i send marketing emails","marketing rules","bulk sms","newsletter consent","promotional emails","marketing compliance"]

answer:
  📧 **Direct Marketing Rules Under DPA 2019**

  Sending promotional emails, SMS or calls? Here's what the law requires:

  **Before sending marketing:**
  • You must have a **valid lawful basis** — usually explicit consent, or existing customer relationship (soft opt-in)
  • Be clear about what people are signing up for — 'updates from us' is not specific enough
  • Keep records of when and how consent was obtained

  **Every marketing message must include:**
  • Clear identification of who is sending it
  • An easy way to **opt out / unsubscribe**

  **Opt-out rules:**
  • Anyone can object to marketing at any time — this is an absolute right
  • Once someone opts out, **stop immediately** — no more messages from you
  • You must comply with opt-out requests **without undue delay**

  ⚠️ Ignoring an opt-out request is a violation of the DPA.

  📖 *Source: DPA 2019, Sections 33 & 34*


category: Workplace
topic: Employee data and workplace monitoring
created_at: 2026-05-22 20:15:33
keywords:
  ["employee","staff","hr","payroll","monitoring","workplace","cctv","biometric","attendance","leave","salary"]

phrases:
  ["employee data","staff data","hr data","employee monitoring","cctv at work","biometric attendance","can i monitor employees","employee privacy","payroll data","staff records","workplace data protection"]

answer:
  👔 **Employee Data — What Your HR Team Needs to Know**

  Your employees are data subjects too, with full rights under the DPA 2019.

  **You can lawfully process employee data for:**
  • Managing the employment relationship (contracts, payroll, leave)
  • Legal compliance (NSSF, NHIF, KRA reporting)
  • Safety and security (reasonable CCTV coverage)

  **Transparency is key:**
  • Staff must be informed about what data you collect and why — via an **Employee Privacy Notice**
  • This is separate from your general privacy policy

  **Biometric attendance systems:**
  Fingerprints and facial recognition are **sensitive data**. You need:
  • A valid lawful basis (usually contractual necessity or legitimate interest)
  • A DPIA before deploying the system
  • Clear notice to employees about how biometric data is used and stored

  **Employee monitoring (email, internet, GPS tracking):**
  • Must be proportionate and necessary
  • Employees must be informed in advance
  • Blanket surveillance without notice is generally not lawful

  📖 *Source: DPA 2019, Sections 25–30*


category: Soul Guard
topic: About Soul Guard and services
keywords: ["soul guard","soulguard","services","offerings","what","platform","help","contact","support"]
created_at: 2026-05-22 20:15:33
phrases:
  ["what is soul guard","about soul guard","what does soul guard do","soul guard services","soul guard platform","tell me about soul guard","what can soul guard do","how can soul guard help","soul guard compliance"]

answer:
  🛡️ **About Soul Guard**

  Soul Guard is a **Kenya DPA 2019 compliance platform** designed to make data protection manageable — especially for organisations that don't have a large legal or compliance department.

  **What Soul Guard offers:**
  • 📊 **Compliance Dashboards** — track your compliance score in real time
  • 📋 **DPIA Automation** — guided DPIA templates that meet ODPC standards
  • 🚨 **Breach Management** — log, track and report data breaches with automatic 72-hour timers
  • 📁 **RoPA Builder** — document all your data flows in one place
  • ⚖️ **DSR Management** — handle data subject requests and track the 21-day deadline
  • 👤 **Outsourced DPO** — expert DPO coverage without a full-time hire
  • 📚 **Staff Training** — data protection awareness for your team

  **Get in touch:**
  📧 support@soulguard.co.ke

  I'm Patricia — part of the Soul Guard family. Let me know what else I can help with!


category: General
topic: Thank you
keywords: ["thank","thanks","appreciate","helpful","great","perfect","brilliant","good","nice"]
created_at: 2026-05-22 20:15:33
phrases:
  ["thank you","thanks","thank you so much","that was helpful","you are helpful","very helpful","great help","that helped","nice one","well done"]

answer:
  You're very welcome! That's exactly what I'm here for. 😊

  Feel free to come back any time you have a data protection question. And if I ever can't answer something, I'll connect you with someone on the Soul Guard team who can.

  Stay protected out there! 🛡️


category: General
topic: What Patricia can help with
keywords: ["what","help","topics","cover","know","about","capabilities","do"]
created_at: 2026-05-22 20:15:33
phrases:
  ["what can you do","what can you help with","what do you know","what topics","what can you tell me","help me","what do you cover","show me topics","list of topics"]

answer:
  Happy to give you a rundown! Here's what I know well:

  📋 **Fundamentals**
  • What is data protection and the DPA 2019?
  • The 7 principles of data protection
  • What is personal data?
  • What is sensitive data?

  🏛️ **ODPC**
  • Registration process and fees
  • ODPC location and contacts
  • How to lodge a complaint
  • Penalties and enforcement

  🚨 **Breach Management**
  • 72-hour notification rule
  • What counts as a breach?

  ⚖️ **Rights & Obligations**
  • All 8 data subject rights
  • Lawful basis for processing
  • Consent requirements
  • Privacy notices

  📁 **Documentation**
  • RoPA (Record of Processing Activities)
  • DPIAs
  • Data retention policies

  🌍 **Special Topics**
  • Cross-border transfers
  • Children's data
  • Employee / HR data
  • Direct marketing rules

  📊 **Your Dashboard**
  • 'My compliance score'
  • 'How do I improve my score?'

  Just ask — I'll do my best to help!


