ADVOKS GLOBAL · KENYA
Data Protection Act
2. Interpretation
Edition: 2022-12-31 · In force
2. Interpretation
In this Act, unless the context otherwise requires—"anonymisation" means the removal of personal identifiers from personal data so that the data subject is no longer identifiable;"biometric data" means personal data resulting from specific technical processing based on physical, physiological or behavioural characterisation including blood typing, fingerprinting, deoxyribonucleic acid analysis, earlobe geometry, retinal scanning and voice recognition;"Cabinet Secretary" means the Cabinet Secretary responsible for matters relating to information, communication and technology;"consent" means any manifestation of express, unequivocal, free, specific and informed indication of the data subject's wishes by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to the data subject;"data" means information which—(a)is processed by means of equipment operating automatically in response to instructions given for that purpose;(b)is recorded with intention that it should be processed by means of such equipment;(c)is recorded as part of a relevant filing system;(d)where it does not fall under paragraphs (a), (b) or (c), forms part of an accessible record; or(e)is recorded information which is held by a public entity and does not fall within any of paragraphs (a) to (d)."Data Commissioner" means the person appointed under section 6;"data controller" means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of processing of personal data;"data processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller;"data subject" means an identified or identifiable natural person who is the subject of personal data;"encryption" means the process of converting the content of any readable data using technical means into coded form;"filing system" means any structured set of personal data which is readily accessible by reference to a data subject or according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;"health data" means data related to the state of physical or mental health of the data subject and includes records regarding the past, present or future state of the health, data collected in the course of registration for, or provision of health services, or data which associates the data subject to the provision of specific health services;"identifiable natural person" means a person who can be identified directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social or social identity;"national security organs" has the meaning assigned to it under Article 239 of the Constitution;"Office" means the office of the Data Protection Commissioner;"person" has the meaning assigned to it under Article 260 of the Constitution;"personal data" means any information relating to an identified or identifiable natural person;"personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;"processing" means any operation or sets of operations which is performed on personal data or on sets of personal data whether or not by automated means, such as(a)collection, recording, organisation, structuring;(b)storage, adaptation or alteration;(c)retrieval, consultation or use;(d)disclosure by transmission, dissemination, or otherwise making available; or(e)alignment or combination, restriction, erasure or destruction."profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's race, sex, pregnancy, marital status, health status, ethnic social origin, colour, age, disability, religion, conscience, belief, culture, dress, language or birth; personal preferences, interests, behaviour, location or movements;"pseudonymisation" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, and such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data is not attributed to an identified or identifiable natural person;"register" means the register kept and maintained by the Data Commissioner under section 21;"restriction of processing" means the marking of stored personal data with the aim of limiting their processing in the future;"sensitive personal data" means data revealing the natural person's race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of the person's children, parents, spouse or spouses, sex or the sexual orientation of the data subject; and"third Party" means natural or legal person, public authority, agency or other body, other than the data subject, data controller, data processor or persons who, under the direct authority of the data controller or data processor, are authorised to process personal data.