Digital Health Act

33. Duty to protect sensitive personal data

Edition: 2023-11-24 · In force

33. Duty to protect sensitive personal data

(1)A data controller shall protect sensitive personal data and adopt reasonable administrative, technical and physical safeguards to ensure the privacy, confidentiality, security, accuracy and integrity of the data.

(2)A data controller shall establish controls that govern persons who may use sensitive personal data and such data shall not be used unless—

(a)the identity of the person seeking to use the information is verified;

(b)the data processor is authorized to use it; and

(c)the proposed use is authorised under this Act.

← Previous provision Next provision →

Source: Kenya Law