Data Protection Act

65. Compensation to a data subject

Edition: 2022-12-31 · In force

65. Compensation to a data subject

(1)A person who suffers damage by reason of a contravention of a requirement of this Act is entitled to compensation for that damage from the data controller or the data processor.

(2)Subject to subsection (1)—

(a)a data controller involved in processing of personal data is liable for any damage caused by the processing; and

(b)a data processor involved in processing of personal data is liable for damage caused by the processing only if the processor—

(i)has not complied with an obligation under the Act specifically directed at data processors; or

(ii)has acted outside, or contrary to, the data controller's lawful instructions.

(3)A data controller or data processor is not liable in the manner specified in subsection (2) if the data controller or data processor proves that they are not in any way responsible for the event giving rise to the damage.

(4)In this section, "damage" includes financial loss and damage not involving financial loss, including distress.

← Previous provision Next provision →

Source: Kenya Law