41 2019 Data Protection No. (a) the requirements which are imposed on a data controller or data processor when processing personal data; (b) mechanisms of conducting certification program; (c) the contents which a notice or registration by a data controller or data processor should contain; (d) information to be provided to a data subject and how such information shall be provided; (e) the levying of fees and taking of charges; (f) the measures to safeguard a data subject’s rights, freedoms and legitimate interests; (g) the processing of data through a data server or data centre in Kenya; (h) issuing and approval of codes of practice and guidelines; or (i) any other matter that the Cabinet Secretary may deem fit. (3) For the purposes of Article 94(6) of the Constitution— (a) the purpose and objective of the delegation under this section is to enable the Cabinet Secretary to make regulations for better carrying into effect the provisions of this Act; (b) the authority of the Cabinet Secretary to make regulations under this Act will be limited to bringing into effect the provisions of this Act and fulfilment of the objectives specified under this section. (4) The principles and standards applicable to the delegated power referred to under this Act are those found in— (a) the Statutory Instruments Act, 2013; (b) the Interpretation and General Provisions Act; (c) the general rules of international law as specified under Article 2(5) of the Constitution; and (d) any treaty and convention ratified by Kenya under Article 2(6) of the Constitution. No. 23 of 2013. Cap 2. !