Data protection should be discussed while a system is being planned, not after it has collected customer or employee information. The first step is to understand what information the workflow needs and who is responsible for it.
This article is a project-planning checklist, not legal advice. Kenyan requirements and each organization’s responsibilities depend on the specific processing. Consult a qualified privacy professional or legal adviser for decisions about compliance.
In Kenya, the main framework is the Data Protection Act, 2019, overseen by the Office of the Data Protection Commissioner (ODPC). The questions below help you prepare for a conversation with your adviser about how the Act applies to your system.
Map the information and its purpose
List the personal information the system will handle, where it comes from, why it is needed, and which roles use it. Include information sent to connected services, reports, exports, backups, and support tools. If a field has no clear purpose, consider whether the system should collect it at all.
Separate operational information from optional analytics or marketing use. A system should make it possible to explain why information is collected and to avoid retaining extra data simply because storage is available.
Define access by role
Give each user the information and actions needed for their job. Consider managers, field staff, finance, customer support, and external providers separately. Review who can download, export, edit, or delete records, and make access changes when a person changes role or leaves.
For sensitive actions, decide whether the system needs additional verification, an approval step, or an audit record. Use individual accounts so activity can be attributed to the right person.
Agree retention and deletion rules
Decide how long different records need to remain available, who approves deletion, and what happens to copies in exports and backups. Retention should match operational and legal requirements; an engineer should not choose the period without the business and its advisers.
Ask how a person can correct information, how records can be retrieved, and how the organization handles a valid deletion or access request where applicable.
Review connected providers
List hosting, email, payment, analytics, messaging, and other services that may receive data. Understand what each provider processes, which organization controls the account, how access is secured, and how data can be exported or removed if a service is changed.
Document who manages vendor access and credentials. Keep production secrets outside public code and restrict them to the people and services that need them.
Prepare for incidents
Agree who receives a security report, who investigates it, how access can be restricted, and how evidence is preserved. Keep contact details and escalation steps current. The response plan should identify when privacy or legal advisers need to be involved.
Questions for project discovery
- What personal information is essential to the workflow?
- Which users can view, change, export, or delete it?
- Which external services receive any of the information?
- How are access changes and important actions recorded?
- Who decides retention periods and handles privacy requests?
- Who leads the response if information may have been exposed?
Treat these questions as design inputs and confirm legal obligations with an appropriate specialist. For broader project planning, read how to choose a software development partner.