ADVOKS GLOBAL · KENYA
Data Protection Act
34. Restrictions on processing
Edition: 2022-12-31 · In force
34. Restrictions on processing
(1)A data controller or data processor shall, at the request of a data subject, restrict the processing of personal data where—(a)accuracy of the personal data is contested by the data subject, for a period enabling the data controller to verify the accuracy of the data;(b)personal data is no longer required for the purpose of the processing, unless the data controller or data processor requires the personal data for the establishment, exercise or defence of a legal claim;(c)processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; or(d)data subject has objected to the processing, pending verification as to whether the legitimate interests of the data controller or data processor overrides those of the data subject.(2)Where processing of personal data is restricted under this section—(a)the personal data shall, unless the data is being stored, only be processed with the data subject's consent or for the establishment, exercise or defence of a legal claim, the protection of the rights of another person or for reasons of public interest; and(b)the data controller shall inform the data subject before withdrawing the restriction on processing of the personal data.(3)The data controller or data processor shall implement mechanisms to ensure that time limits established for the rectification, erasure or restriction of processing of personal data, or for a periodic review of the need for the storage of the personal data, is observed.