When you need a data protection impact assessment
When Kenya's Data Protection Act requires an impact assessment, the sixty-day rule for submitting it, and a light template a business can use.
By Achekam · · 5 min read · For Running a business businesses in Kenya
A new system is about to go live. Perhaps it is a biometric clock-in for staff, a customer app that collects ID numbers and locations, or an AI tool that reads invoices and payslips. Somewhere in the planning, someone asks: do we need a data protection impact assessment before we switch this on?
In Kenya, sometimes you do, and the timing is strict. The Data Protection Act requires the assessment before the processing starts, and in the cases it covers, the report goes to the Data Commissioner well ahead of launch. This article explains when the duty applies, what the timeline looks like and how to run a proportionate assessment without turning it into a consulting project.
What the law requires
Section 31 of the Data Protection Act requires a data protection impact assessment before processing that is likely to result in high risk to data subjects. The report must be submitted sixty days before the processing begins. If the assessment shows high risk, the Data Commissioner must be consulted first.
So there are two triggers to watch:
- Likely high risk means an assessment is required before you start.
- High risk shown by the assessment means you consult the Data Commissioner before going ahead.
The Act is one part of a wider framework. The ODPC's page on data protection laws in Kenya lists the Data Protection Act, 2019 alongside the Data Protection (General) Regulations, 2021, the Registration of Data Controllers and Data Processors Regulations, 2021 and the Complaints Handling and Enforcement Regulations, 2021. The regulations add detail to the Act, so read them alongside it when deciding whether your project is in scope.
Recognising processing that may be high-risk
The Act's test is risk to the people whose data you handle, not risk to the business. Questions like these suggest a project deserves a closer look:
- Does it involve sensitive information, such as health, biometric or financial details?
- Does it monitor people, for example staff movements or customer behaviour, over time?
- Does it combine data from different sources to build a picture of individuals?
- Does it make or prepare decisions that affect people, such as credit or hiring?
- Will data go to another organisation, or outside Kenya?
- Is it new technology the business has not used before?
A "yes" to one of these does not by itself mean the processing is high-risk in law. Several "yes" answers together are a strong signal to run the assessment and keep a record of the conclusion.
The sixty-day timeline
Because the report goes in sixty days before processing, the assessment has to be part of the project plan, not a box ticked at go-live. Work backwards from the launch date:
- Launch date.
- Sixty days before: the report submitted.
- Before that: the assessment completed and signed off internally.
- Before that: enough of the design settled that the assessment describes what will actually happen.
If the assessment finds high risk, add time for consulting the Data Commissioner before you go ahead.
Testing against the section 25 principles
The heart of any assessment is a check against the principles in section 25 of the Act. Personal data must be:
- collected for explicit, specified and legitimate purposes;
- limited to what is necessary for those purposes;
- kept accurate;
- kept no longer than necessary;
- not transferred outside Kenya without proof of adequate safeguards or the data subject's consent.
Each principle becomes a question about your project. Why do we need each field? Could we collect less? How will errors be corrected? When will we delete it? Where will it go? Transfers out of Kenya are covered in more depth in personal data outside Kenya.
The stakes are real. Section 63 caps an administrative fine at five million shillings or, for an undertaking, one per centum of its annual turnover for the preceding financial year, whichever is lower.
AI features in Achekam: vendors, keys and switching AI off
If your assessment covers Achekam, the AI features deserve their own entry, because they involve outside vendors.
Achekam's AI features go through one AI engine that can use Anthropic, OpenAI, Google Gemini, DeepSeek or xAI. It uses the workspace's own API key first, and the platform's key only where that is allowed. Administrators manage this under Settings in "AI models, keys, routing & spend". With no key at all, every AI feature says so and drafts nothing. For your assessment, record which vendors your workspace uses and on whose key.
The AI Activity Log lists every AI request with its vendor, model, tokens and estimated cost, which gives you evidence of what was actually sent rather than what was intended. A workspace administrator can switch AI off for the whole workspace if the assessment concludes that it should not be used yet.
For documents, the Document Intelligence reader refuses restricted classes of data, such as payroll and bank data, unless they have been allowed for a particular purpose. That is a useful control to describe in the assessment, and a setting to check before go-live.
A light assessment template
For most small and medium projects, a few pages covering these headings is enough:
| Heading | What to write |
|---|---|
| The project | What it does, who runs it, when it starts |
| The data | Which personal data, about whom, from where |
| Purpose | Why each item is needed |
| Flows | Who receives it, including vendors, and whether it leaves Kenya |
| Principles | How each section 25 principle is met |
| Risks | What could harm the people involved, and how likely it is |
| Controls | What reduces each risk, such as access limits or switching a feature off |
| Conclusion | High risk or not, and whether to consult the Data Commissioner |
| Sign-off | Who approved it and when |
Staff data is a common subject for assessments; protecting employees' personal data covers the payroll side. If you have not yet checked whether your business must register with the ODPC, see who must register with the ODPC.
Pick the next system you plan to launch, put its go-live date on a page, and count back sixty days. If that date has already passed, the assessment is the first thing to schedule.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
