Data Protection Act, 2019, rights of data subjects and automated decision-making
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 25 November 2019.
A data subject rights rule binding public and private bodies.
As of 4 September 2026.
What it requires
- Notify a data subject in writing when a decision about them is based solely on automated processing, including profiling, that produces a legal or similarly significant effect, and allow them to request reconsideration or a new decision that is not based solely on automated processing.
- Respond to a data subject's request to access, correct or delete their personal data, and to a data portability request within thirty days.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Every data subject has a right to be informed of the use of their personal data, to access it, to object to its processing, and to correction or deletion of false or misleading data.
Section 35 gives a data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect or significantly affects them, and requires the controller to notify the subject in writing and allow them to seek reconsideration or a new decision not based solely on automated processing.
A data subject also has a right to data portability in a structured, commonly used and machine-readable format, and a controller must comply with a portability request within thirty days.
When LexLint raises it
high_risk_decisionscrawls_webtrains_modelsdeploys_chatbot
Read the law
official consolidated Act text, Kenya Law (National Council for Law Reporting)