ADVOKS GLOBAL · KENYA
The Data Protection (Civil Registration) Regulations
28. Data security procedure.
Edition: 2022-12-31 · In force
28. Data security procedure.
(1)A civil registration entity shall formulate a written data security procedure for its entity.(2)The procedure specified under paragraph (1) shall be binding upon the authorized officer and shall include—(a)instructions concerning physical protection of the database sites and their surroundings;(b)access authorizations to the database and database systems;(c)description of the means intended to protect the database systems and the manner of their operation for this purpose;(d)instructions to authorized officer of the database and database systems regarding the protection of data stored in the database;(e)the risks to which the data in the database is exposed in the course of the civil registration entity's ongoing activities;(f)the manner of dealing with information security incidents, according to the severity of the incident;(g)instructions concerning the management and usage of portable devices;(h)instructions with respect to conducting periodical audits to ensure that appropriate security measures, in accordance with the Procedure and these Regulations exist; and(i)instructions regarding backup of personal the data.(3)The civil registration entity shall, on an annual basis, assess the need to update the security procedure.(4)Despite paragraph (3), the civil registration entity shall assess whether the security procedure requires to be updated in the following instances—(a)material modifications in the database systems; or(b)new technological risks relating to the database systems are known.(5)A civil registration entity that controls several databases may develop a data security procedure in accordance with these Regulations in a single document that concerns all databases it controls.