When a DPIA is required
Section 31 of the Data Protection Act, 2019 requires a data protection impact assessment where a processing operation is likely to result in a high risk to the rights and freedoms of data subjects, by virtue of its nature, scope, context and purposes. The General Regulations list processing that is treated as high risk. In practice, plan a DPIA for:
- Biometric or genetic data, such as fingerprint attendance systems
- Large-scale processing of sensitive data, including health data
- Systematic monitoring, such as CCTV over public areas or employee tracking
- Automated decisions with legal or similar effects, such as credit scoring
- New technologies, and combining datasets from different sources
- Processing children's data at scale
What the assessment contains
- A systematic description of the processing and its purposes
- An assessment of whether the processing is necessary and proportionate
- An assessment of the risks to data subjects
- The measures to address those risks, including safeguards and security
Submitting it to the Data Commissioner
Unlike the GDPR, which only requires consultation where high risk remains, the Kenyan Act requires the assessment to be submitted to the Data Commissioner ahead of the processing; the Act sets a period of sixty days before the processing begins. Build that lead time into project plans: a DPIA started the week before launch is already late.
hlola raises a DPIA automatically when a processing activity records sensitive data, scores the risk, routes it for approval and tracks remediation. See DPIA in hlola.
Common questions
Is a DPIA mandatory in Kenya?
Yes, where processing is likely to result in a high risk to data subjects' rights and freedoms, under section 31 of the Data Protection Act, 2019.
Do we have to send the DPIA to the ODPC?
Yes. The Kenyan Act requires the assessment to be submitted to the Data Commissioner before the processing begins.
Does CCTV need a DPIA?
Systematic monitoring of publicly accessible areas is a typical high-risk trigger, so large or covert CCTV schemes should be assessed.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.