Data Protection Act, 2019

The Data Protection Act, 2019 governs how personal information is handled in Kenya. This page sets out how the county meets it in this service. What information is collected and why is set out in the Privacy Notice.

The principles, and how they are met

Lawfulness and purpose. Personal information is collected to decide development applications — a statutory function — and is not used for anything else.

Minimisation. Only what an application actually requires is asked for. A field that no decision depends on is not collected.

Accuracy. You can correct your own details at any time from your account. An application already lodged is a record and is not edited; corrections are made by revising the application.

Storage limitation. Records are kept under the county's retention schedule. Statutory decisions are permanent records.

Security. Passwords are stored hashed and cannot be read by anybody, including county staff. Sensitive settings are held encrypted. Uploaded documents are stored outside the public web root and are served only to people entitled to see them. Every action on a file is recorded in an audit trail that cannot be altered or deleted, including by an administrator.

Accountability. Who did what, when, and why is recorded for every decision on every file.

Data subject rights

You may ask for access to your information, its correction, or its erasure where the county is not required to keep it; you may object to processing, and you may ask for your information in a portable form.

Requests are answered within the time the Act allows.

Complaints

If you are not satisfied with how the county has handled your information, you may complain to the Office of the Data Protection Commissioner.

Breaches

Where a breach is likely to result in a risk to your rights and freedoms, the county will notify the Data Protection Commissioner and, where the Act requires it, you.