We help organisations build and implement compliance programmes under Kenya's Data Protection Act, 2019, including alignment with international standards such as GDPR. Our advisory covers data governance policies, cross-border transfer protocols, privacy-by-design integration, and breach response planning.
We conduct comprehensive privacy and security audits for financial institutions, technology companies, telecommunications providers, and government entities, resulting in enterprise-wide data protection frameworks that are practical, enforceable, and regulatorily defensible.
We represent clients in regulatory investigations by the Data Commissioner, advising on response strategy, negotiating remediation measures, and managing the reputational and legal dimensions of enforcement proceedings. Our experience includes responding to investigations into large-scale data breaches.
We have acted for government departments in landmark constitutional petitions concerning data privacy rights, including the challenge to the Maisha Number digital identity programme. This experience gives us an unmatched understanding of how privacy rights are balanced against legitimate state interests in Kenya.
Our Data Protection practice covers the full lifecycle of data governance, from initial compliance programme design through to regulatory investigations and constitutional litigation. We have advised a leading telecommunications company on a group-wide compliance programme under the Kenya Data Protection Act, including cross-border data transfer protocols; conducted a comprehensive privacy audit for a major bank resulting in an enterprise-wide framework; represented a technology firm responding to a regulatory investigation into a large data breach; and acted for a State Department in a landmark constitutional petition concerning digital identity and privacy rights. We also assist government agencies in drafting regulations and guidelines under the Data Protection Act, contributing directly to national privacy policy development.
Data protection is no longer a compliance afterthought, it carries constitutional, regulatory, and commercial weight. Clients trust us in this space because we have operated at every level of the issue: we have designed enterprise compliance frameworks for corporates, represented the government in constitutional privacy litigation, assisted in drafting national regulations, and defended clients in front of the Data Commissioner. That breadth of experience, from the boardroom to the courtroom, means we understand data protection not as an abstract legal obligation but as a real risk with real consequences that we know how to manage.
