Do we need to register with the Data Commissioner?

It depends on turnover, staff numbers and the nature of the processing. Some activities require registration regardless of size, including processing on a large scale, and processing health, financial or children’s data.

We had a data breach. What are the deadlines?

Notification to the Office of the Data Protection Commissioner is required without undue delay and within seventy-two hours where the breach presents a real risk to the rights of the people affected, with communication to those people where that risk is high.

Is a climate commitment legally binding?

A public statement can create exposure under consumer, securities and contract law even where no climate statute applies. Before a target is announced we look at what has been promised, to whom, and what evidence will support it.

Can IVIO Advocates act as our outsourced compliance function?

Yes. We take on fractional compliance management with a defined scope, a reporting line to the board, and an agreed monthly fee.

Should I sue or settle?

It depends on what you can prove, what the other side can pay, and what the delay costs you. We give you the merits and the recovery prospects separately.

Is a handwritten will valid in Kenya?

A written will must be signed by the maker and attested by at least two competent witnesses who are not beneficiaries. Oral wills are recognised in narrow circumstances only.

How long does probate take?

An uncontested grant, with complete documents and a clear asset schedule, commonly takes several months including the statutory period before confirmation.

Corporate and commercial — IVIO Advocates

What we do

We incorporate companies and limited liability partnerships, prepare shareholder and partnership agreements, and put in place the board and shareholder resolutions that decisions actually require. On the commercial side we draft and negotiate supply, distribution, services, licensing, employment and lease agreements, and we review the contracts a client is being asked to sign.

Our advisory work covers regulatory permissions, data protection compliance under the Data Protection Act 2019, policies and staff handbooks, and the governance questions that arise when a business grows faster than its documents. Where a matter touches compliance systems at scale, we bring in MZIZI, the firm's innovation arm.

Public-sector and tender work

We advise bidders and suppliers on public procurement: eligibility and documentation, the terms of a tender, contract award and administration, and review proceedings before the Public Procurement Administrative Review Board. Deadlines in procurement are short and unforgiving, so we work to the tender calendar rather than our own.

Questions clients ask

Do we need a shareholders' agreement if we have articles?

Usually yes. The articles govern the company; the shareholders' agreement governs the relationship between the owners — what happens when one of you wants out, dies, or disagrees. Those are the moments that break businesses.

Can you review a contract quickly?

Yes. Tell us the deadline and the commercial outcome you want, and we will come back with the clauses that matter and a plain-language note on the risk you are being asked to carry.

What does data protection compliance involve?

At minimum: knowing what personal data you hold and why, a lawful basis for each use, a privacy notice that matches practice, registration with the Office of the Data Protection Commissioner where it applies, and a way of handling data-subject requests.