Practice area
Advisory: data protection and climate compliance
Two bodies of obligation that now reach almost every organisation in Kenya, and that are usually handled by the same people. We build the compliance position, document it, and keep it defensible when a regulator, a lender or a customer asks for evidence.
Data protection
We advise controllers and processors on the Data Protection Act 2019 and the regulations made under it. The work begins with a record of what personal data the organisation holds, where it came from, why it is held and who it is shared with, because nothing else can be assessed without that. From there we establish a lawful basis for each processing activity, draft privacy notices and internal policies that describe what actually happens, and put in place the contracts the Act requires between controllers and their processors.
We prepare and review data protection impact assessments, advise on registration with the Office of the Data Protection Commissioner, and design the mechanics of data-subject requests, retention and deletion so that a request can be answered inside the statutory period. Where personal data leaves Kenya we advise on the conditions for transfer and document the assessment that supports it. When something goes wrong we handle breach assessment and notification, and represent organisations in complaints and enforcement before the Commissioner.
We also run compliance as an ongoing function rather than a one-off report: audits, staff training, board-level reporting, and fractional compliance management for organisations that are not ready to hire a full-time data protection officer. That capability is delivered with MZIZI, the firm's innovation arm, which maintains the DataHub | Data Protection Africa repository and enforcement database. The same body of enforcement material underpins Data Protection in Kenya, our annotated guide to the Act and the cases decided under it.
Climate and just-transition compliance
Climate obligations arrive through several doors at once: lender and investor conditions, customer procurement standards, reporting expectations from regulators and exchanges, and the terms of the contracts an organisation has already signed. We advise on which of these actually bind the client, what evidence each one requires, and where the exposure sits if a commitment is missed.
In practice that means reviewing and drafting climate-conscious contract clauses covering emissions, reporting, supply-chain standards and remedies; advising boards on governance and disclosure so that a climate statement is supportable; and working through the just-transition questions that arise when an operation, a supplier or a workforce has to change. We draw on The Village, the MZIZI climate network, and the free clause library it publishes.
Questions clients ask
Do we need to register with the Data Commissioner?
It depends on turnover, staff numbers and the nature of the processing. Some activities require registration regardless of size, including processing on a large scale, and processing health, financial or children's data. We will tell you which category you fall into and prepare the application.
We had a breach. What are the deadlines?
Notification to the Commissioner is required without undue delay and within seventy-two hours where the breach presents a real risk to the rights of the people affected, with communication to those people where that risk is high. The first task is a documented assessment of severity, which is also what a regulator will ask to see.
Is a climate commitment legally binding?
A public statement can create exposure under consumer, securities and contract law even where no climate statute applies. Before a target is announced we look at what has been promised, to whom, and what evidence will support it.
Can you act as our outsourced compliance function?
Yes. We take on fractional compliance management with a defined scope, a reporting line to the board, and an agreed monthly fee, which is usually the right route until the volume justifies an internal appointment.