5 2019 Data Protection No. THE DATA PROTECTION ACT, 2019 AN ACT of Parliament to give effect to Article 31(c) and (d) of the Constitution; to establish the Office of the Data Protection Commissioner; to make provision for the regulation of the processing of personal data; to provide for the rights of data subjects and obligations of data controllers and processors; and for connected purposes ENACTED by Parliament of Kenya, as follows— PART I—PRELIMINARY 1. This Act may be cited as the Data Protection Act, 2019. 2. In this Act, unless the context otherwise requires— “anonymisation” means the removal of personal identifiers from personal data so that the data subject is no longer identifiable; “biometric data’’ means personal data resulting from specific technical processing based on physical, physiological or behavioural characterisation including blood typing, fingerprinting, deoxyribonucleic acid analysis, earlobe geometry, retinal scanning and voice recognition; “Cabinet Secretary” means the Cabinet Secretary responsible for matters relating to information, communication and technology; “consent” means any manifestation of express, unequivocal, free, specific and informed indication of the data subject’s wishes by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to the data subject; “data” means information which— (a) is processed by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with intention that it should be processed by means of such equipment; (c) is recorded as part of a relevant filing system; Short title. Interpretation. !