ADVOKS GLOBAL · KENYA
Digital Health Act
25. Retention and disposal of data in system
Edition: 2023-11-24 · In force
25. Retention and disposal of data in system
(1)Data held in the system shall be maintained for a minimum period of twenty years.(2)Data held in the system may be maintained for a period exceeding that specified in subsection (1) where—(a)it is required or authorised by law;(b)it is authorised by the data subject; or(c)it is reasonably necessary for a lawful purpose;(d)for historical, statistical or research purposes.(3)Where the period for the maintenance of the data held in the system is not extended under subsection (2), the data shall be secured by de-identification, anonymization, pseudo-anonymization or archiving, or establishing such technical and organisational security measures as the Cabinet Secretary may determine to be necessary.