Home › Services › Data protection compliance consulting
Data Protection Act compliance for Kenyan organisations
The Kenya Data Protection Act, 2019 applies to almost every organisation that handles customer, staff or visitor data, including CCTV footage and biometric attendance records. APOPS Assurance helps you understand what applies to you, close the gaps and keep the evidence, so you are ready for clients, auditors and the Office of the Data Protection Commissioner (ODPC).
What we help with
- Registration with the ODPC as a data controller or processor
- Gap assessment against the Act and its regulations, with a prioritised action plan
- Data mapping: what personal data you hold, where it is and who can access it
- Data protection impact assessments (DPIAs) for CCTV, biometrics and new systems
- Privacy notices, consent wording, retention schedules and data-sharing agreements
- Data breach response plan and the 72-hour notification process
- Staff awareness training and data protection officer (DPO) support
CCTV and biometric systems
Many organisations overlook the cameras and fingerprint readers on their premises. Because we also install these systems, we review them in practice: where the cameras point, the signage, how long footage is kept, who can export it, and how biometric templates are stored.
Why APOPS Assurance
- Founded in 2016 in Nairobi, working with businesses and institutions across Kenya
- One team for both IT security and physical security, so cameras, access control and networks are designed together
- Our own technicians and auditors, with ISO/IEC 27001 Lead Auditor and information systems audit expertise
- Clear written quotations, and help after installation
Frequently asked questions
Does my business need to register with the ODPC?
Most organisations that process personal data must register as data controllers or processors, with some exemptions for small entities that the regulations define. We check your situation and handle the registration.
Is CCTV footage personal data?
Yes. If people can be identified in footage, it is personal data. You need a lawful purpose, clear signs, limited retention and controlled access.
What happens after a data breach?
Under the Act, a breach that risks harming people must be reported to the Data Commissioner within 72 hours of becoming aware of it, and affected people may need to be told. We help you prepare the process before it happens.
Talk to us
Call +254 722 102 317, email info@apopsassurance.com or visit us at Kimathi House, Kimathi Street, Nairobi.