Data Protection No. 24 of 2019 [Subsidiary] THE DATA PROTECTION (GENERAL) REGULATIONS, 2021 ARRANGEMENT OF SECTIONS PART I – PRELIMINARY 1. 2. 3. Citation Interpretation Exemption 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. PART II – ENABLING THE RIGHTS OF A DATA SUBJECT Processing on the basis of consent Lawful basis for processing Mode of collection of personal data Restriction to processing Objection to processing Data access request Rectification of personal data Data portability request. Right of erasure Exercise of rights by others 14. 15. 16. 17. 18. PART III – RESTRICTIONS ON THE COMMERCIAL USE OF PERSONAL DATA Interpretation of commercial purposes Permitted commercial use of personal data Features of an opt out message Mechanisms to comply with opt out requirement Request for restriction of further direct marketing 19. 20. 21. 22. 23. 24. 25. 26. PART IV – OBLIGATIONS OF DATA CONTROLLERS AND DATA PROCESSORS Retention of personal data Requests to deal anonymously or pseudonymously Sharing of personal data Automated individual decision making Data protection policy Contract between data controller and data processor Obligations of a data processor Requirement for specified processing to be done in Kenya 27. 28. 29. 30. 31. 32. 33. 34. 35. PART V – ELEMENTS TO IMPLEMENT DATA PROTECTION BY DESIGN OR BY DEFAULT A data controller or data processor shall in processing of personal data — Elements of data protection by design or default Elements for principle of lawfulness Elements for principle of transparency Elements for principle of purpose limitation Elements for principle of integrity, confidentiality and availability Elements for principle of data minimization Elements for principle of accuracy Elements for principle of storage limitation 17