The rights
- To be informed of the use to which their personal data is put
- To access their personal data held by a controller or processor
- To object to the processing of all or part of their personal data
- To correct false or misleading data
- To delete false or misleading data
- To data portability (section 38)
- Not to be subject to a decision based solely on automated processing that significantly affects them (section 35)
How fast you must respond
The Data Protection (General) Regulations, 2021 set out how requests are made and answered. For access requests the period is short: hlola works to seven days from receipt. Requests may arrive by email, letter, phone, WhatsApp or in person, and the clock runs from receipt in any channel, so every channel needs a route into one register.
If you refuse a request, you must tell the person why and that they may complain to the Data Commissioner.
Handling a request step by step
- Log the request with the time it arrived and the channel
- Verify the requester's identity before releasing any data
- Search every system that holds their data, using your data map
- Apply any lawful exemption, and record it
- Respond in writing, in a format the person can use
- Keep the response, and the evidence of when it was sent
hlola's Data Subject Portal gives people a public page to make requests and a private link to follow them, sets the deadline from the law of your entity's country, and blocks release until identity is verified.
Common questions
What rights do data subjects have in Kenya?
Section 26 of the Data Protection Act, 2019 gives the rights to be informed, to access, to object, and to correct or delete false or misleading data. The Act also provides data portability and protection from solely automated decisions.
How long do I have to respond to an access request in Kenya?
The Data Protection (General) Regulations, 2021 set a short period; hlola works to seven days from receipt. Confirm the period that applies to your request type with counsel.
Can we charge for an access request?
Requests should generally be handled without charge. Build your process on that basis and take advice before levying any fee.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.