How to Do a Data Protection Impact Assessment (DPIA) in Kenya
When the Kenya Data Protection Act requires a DPIA, what it must cover, how to run one step by step, and the mistakes that make it useless.
· Reviewed by Danstan Akwiri, CISSP, CISA
Section 31 of the Kenya Data Protection Act, 2019 requires a data protection impact assessment (DPIA) where a processing operation is likely to result in a high risk to the rights and freedoms of the people whose data is processed. The Data Protection (General) Regulations, 2021 describe the kinds of processing that call for one, and the Office of the Data Protection Commissioner has published guidance on how to carry it out.
Done well, a DPIA is the cheapest privacy control there is: it finds the problems in a new system while they are still design decisions rather than production incidents. This guide explains when you need one, what it must cover, how to run one step by step, and what the ODPC expects you to do with the result.
| Likely needs a DPIA | Usually does not on its own |
|---|---|
| Processing health, biometric, genetic or children's data at scale | A small staff contact list |
| Systematic monitoring of people, such as tracking customers or CCTV over public areas | A one-off survey with no sensitive questions |
| Automated decisions with significant effects, such as credit scoring | Routine payroll for your own employees |
| New technology applied to personal data, such as AI or facial recognition | Moving an existing, assessed system to a new server |
| Large-scale processing or combining datasets from different sources | Processing anonymised statistics |
When a DPIA is required
The test in the Act is risk, not size. A DPIA is required where processing is likely to result in a high risk to people's rights and freedoms, by virtue of its nature, scope, context and purposes. In practice that captures most processing of sensitive personal data at scale, systematic monitoring, profiling and automated decision-making, and the use of new technologies on personal data.
If you are unsure, do a short screening: write down what data, whose, how much, for what purpose and using what technology. If any of the high-risk indicators in the table apply, carry out the full assessment. A screening that concludes no DPIA is needed should itself be kept on file.
What a DPIA must cover
The Act sets out the minimum content. Your assessment should include:
- A systematic description of the processing: what data, about whom, from where, for what purpose, who it is shared with and how long it is kept.
- An assessment of whether the processing is necessary and proportionate to that purpose.
- An assessment of the risks to the rights and freedoms of the people involved.
- The measures you will take to address those risks: safeguards, security measures and mechanisms that protect the data and demonstrate compliance with the Act.
Running a DPIA step by step
A useful DPIA follows the data rather than the form. The steps below work for most systems.
- Start early, at design stage, when changing the system is still cheap.
- Map the data flow end to end: collection, storage, access, sharing, retention and deletion, including every vendor and integration.
- Test necessity: for each data field, ask whether you genuinely need it for the stated purpose. Fields you do not collect cannot leak.
- Identify risks from the data subject's point of view: unauthorised access, excessive collection, inaccuracy, unexpected sharing, and decisions people cannot challenge.
- Rate each risk for likelihood and severity, then decide the control: encryption, access control, minimisation, retention limits, contractual terms with vendors, or a change to the design.
- Record the residual risk after controls, get sign-off from management and your Data Protection Officer, and keep the assessment under review as the system changes.
Consulting the Data Commissioner
Where a DPIA shows that processing would still carry a high risk after your planned mitigations, the Act requires you to consult the Data Commissioner before you begin. The Act also provides for the assessment to be submitted to the Data Commissioner sixty days before the processing starts, so build that time into your project plan rather than discovering it a week before launch. Check the ODPC's current procedure when you prepare to submit.
Prior consultation is not a formality. The ODPC can advise on changes, so the earlier you engage, the less likely you are to have to rework a finished system.
Mistakes that make a DPIA useless
The most common failure is completing the DPIA after the system is built, purely to have a document. By then every risk is "accepted" because changing anything is expensive, and the assessment protects nobody.
The second is writing it without looking at the system. A DPIA that says data is encrypted at rest, when nobody has checked the database, is worse than none, because it creates false assurance. Someone technical should verify each claim. The third is never revisiting it: a system that adds a new integration or a new category of data needs the assessment updated.
Key takeaways
- Section 31 of the Act requires a DPIA where processing is likely to result in high risk to people's rights and freedoms.
- Sensitive data at scale, systematic monitoring, automated decisions and new technology are the usual triggers.
- Cover the description of processing, necessity and proportionality, the risks, and the measures to address them.
- Do it at design stage, follow the actual data flow, and have someone technical verify the claims.
- If high risk remains after mitigation, consult the Data Commissioner before processing begins, and allow for the sixty-day submission period.
Frequently asked questions
Is a DPIA the same as a privacy impact assessment?
The terms are often used interchangeably. Under the Kenya Data Protection Act the formal term is data protection impact assessment, and that is what the ODPC expects to see.
Who should carry out the DPIA?
The data controller is responsible for it. In practice it is led by the Data Protection Officer or privacy lead with input from the system owner, IT and security, and any vendor involved. The DPO should review and advise on the result.
Do we need a DPIA for a system we already run?
If it carries high risk and was never assessed, yes, it is good practice to assess it now, and you must when you make significant changes to it. Prioritise systems holding sensitive data or used to make decisions about people.
How long does a DPIA take?
For a single, well-understood system, a few weeks including data mapping and review. Complex platforms with many integrations take longer. Remember to allow for the submission period before processing starts.
Can Neurobyte carry out a DPIA for us?
Yes. Because we are engineers as well as privacy specialists, we map how the system actually handles data, verify the security claims, and can fix the gaps the assessment finds rather than only recording them.