Do we need to register with the Data Commissioner?

It depends on turnover, staff numbers and the nature of the processing. Some activities require registration regardless of size, including processing on a large scale, and processing health, financial or children’s data.

We had a data breach. What are the deadlines?

Notification to the Office of the Data Protection Commissioner is required without undue delay and within seventy-two hours where the breach presents a real risk to the rights of the people affected, with communication to those people where that risk is high.

Is a climate commitment legally binding?

A public statement can create exposure under consumer, securities and contract law even where no climate statute applies. Before a target is announced we look at what has been promised, to whom, and what evidence will support it.

Can IVIO Advocates act as our outsourced compliance function?

Yes. We take on fractional compliance management with a defined scope, a reporting line to the board, and an agreed monthly fee.

Should I sue or settle?

It depends on what you can prove, what the other side can pay, and what the delay costs you. We give you the merits and the recovery prospects separately.

Do we need a shareholders’ agreement if we have articles?

Usually yes. The articles govern the company; the shareholders’ agreement governs the relationship between the owners.

Is a handwritten will valid in Kenya?

A written will must be signed by the maker and attested by at least two competent witnesses who are not beneficiaries. Oral wills are recognised in narrow circumstances only.

How long does probate take?

An uncontested grant, with complete documents and a clear asset schedule, commonly takes several months including the statutory period before confirmation.

Insights

Plain-language guides to the law we practise.

Written for the person who has to act on the obligation, not for other lawyers. These notes are general information and not advice on your particular matter.

Data protection · 12 August 2026
When does your organisation need a DPIA?
A data protection impact assessment is not a form to be filed. It is the record that shows you thought about the risk to people before you built the thing, and it is the first document a regulator asks for.
Read the guide →
Data protection · 29 July 2026
Registering with the Data Commissioner
Registration is the most visible compliance obligation under the Data Protection Act 2019, and the one most often missed by organisations that assume it applies only to large companies.
Read the guide →
Data protection · 15 July 2026
Seventy-two hours: handling a data breach
The clock in the Act is short, but the first task is not notification. It is a documented assessment of what happened and who is exposed, because that assessment decides everything that follows.
Read the guide →
Climate · 30 June 2026
Climate clauses that survive a negotiation
Climate obligations reach most organisations through contracts long before they arrive through legislation. The drafting question is not whether to include them, but how to write one that is capable of being enforced.
Read the guide →
Climate · 16 June 2026
Making a climate commitment you can defend
A climate target is a statement about the future made in public. The legal exposure it creates does not depend on a climate statute; it comes from consumer, contract and securities law, which already prohibit saying things that are not so.
Read the guide →
Succession · 2 June 2026
Drafting a valid will in Kenya
Most wills that fail do not fail on their contents. They fail on the formalities, and almost always on the witnessing, which is the one part of the process the maker cannot correct afterwards.
Read the guide →

Plain-language guides to the law we practise.

When does your organisation need a DPIA?

Registering with the Data Commissioner

Seventy-two hours: handling a data breach

Climate clauses that survive a negotiation

Making a climate commitment you can defend

Drafting a valid will in Kenya