No. 24 of 2019 Data Protection [Subsidiary] 36. Elements for principle of fairness 37. 38. PART VI – NOTIFICATION OF PERSONAL DATA BREACHES Categories of notifiable data breach Notification to Data Commissioner 39. 40. 41. 42. 43. 44. 45. 46. 47. 48. PART VII – TRANSFER OF PERSONAL DATA OUTSIDE KENYA Interpretation of the Part VII General principles for transfers of personal data out of the country Transfers on the basis of appropriate safeguards Deeming of appropriate safeguards Binding corporate rules Transfers on the basis of an adequacy decision Transfers on the basis of necessity Transfer on basis of consent. Subsequent transfers. Provisions for the agreement to cross boarder transfer 49. 50. 51. 52. 53. PART VIII – DATA PROTECTION IMPACT ASSESSMENT Processing activities requiring data protection impact assessment Conduct of data protection impact assessment Prior consultation Consideration of the data protection impact assessment report Audit of compliance with Assessment Report 54. 55. 56. 57. PART IX – PROVISIONS ON EXEMPTIONS UNDER THE ACT Exemption for national security Exemptions for public interest Permitted general situation Permitted health situation 58. PART X – GENERAL PROVISIONS Complaints against data controller and data processor SCHEDULES 18