NAKURU, Kenya, February 21 – The Data Commissioner has urged county governments to ensure that contracted third parties comply with the Data Protection Act as part of their compliance obligations to uphold the rights of citizens.
During a county engagement forum with heads of County Departments from 21 counties drawn from Eldoret, Nakuru, and Kisumu regional offices, the data commissioner emphasized that compliance is a shared responsibility.
The event was part of a nationwide series aimed at raising awareness about the compliance journey for devolved units. Key topics covered included the fundamentals of data protection, registration of data handlers, rights of data subjects, and compliance obligations for data handlers.
In her address, the Data Commissioner called for counties to adopt acceptable data processing practices further clarifying that all county departments must register as data controllers and processors to ensure comprehensive compliance at the county level.
“Counties should ensure that all businesses licensed to operate within their jurisdictions comply with the registration requirements under the Act and the Data Protection Registration Regulations. These businesses collect personal data from citizens daily, making it essential for them to register with the Office to ensure proper data handling practices,” she emphasized.
Assistant Data Commissioner for Registration, John Lokwawi, reiterated that implementing these measures will mitigate third-party risks, particularly in cases of personal data mishandling.
“As county governments, we must ensure that contracted third parties implement equivalent measures to protect personal data and handle it properly. Building trust with the public is essential for maintaining their confidence,” he added.
Participating counties included: Kisii, Migori, Nyamira, Kisumu, Siaya, Homa Bay, Vihiga, Trans-Nzoia, Bungoma, Turkana, West Pokot, Kakamega, Busia, Uasin-Gishu, Elgeyo-Marakwet, Nandi, Nakuru, Baringo, Narok, Kericho, and Bomet.
The ODPC is committed to enhancing compliance at the county level through partnerships with county governments, ensuring that all stakeholders are fully registered and compliant with the Data Protection Act.
