Do you need a Data Protection Impact Assessment? A quick test for Kenyan businesses
Kenya's Data Protection Act requires a Data Protection Impact Assessment (DPIA) where a processing activity is “likely to result in high risk” to the rights of the people whose data you hold. That phrase is doing a lot of work, and it's the single most common source of confusion we hear from clients.
A quick, practical test
Rather than parsing the legal language in isolation, we usually walk clients through a few practical questions:
Do you process personal data at scale? A customer database of a few hundred contacts is different from a platform processing data for tens of thousands of users.
Does your processing involve sensitive categories of data? Health information, financial records, biometric data, or data about children raises the risk profile significantly.
Are you introducing new technology to process personal data? New systems — particularly automated decision-making, profiling, or large-scale monitoring — are exactly the kind of activity the Act is designed to catch before it causes harm.
If you answered yes to any of these, a DPIA is worth doing even where it isn't strictly mandatory — it's considerably cheaper to run an assessment up front than to respond to a complaint or a regulatory inquiry after the fact.
What a DPIA actually involves
In practice, we run a DPIA as a structured review: mapping what personal data you collect and why, who has access to it, how long you keep it, what safeguards are in place, and what could realistically go wrong. The output isn't a compliance document that sits in a folder — it should flag specific, fixable gaps, from access controls that are too broad to retention periods that were never formally decided.
DPIA and ISO/IEC 27001
If your organisation is also pursuing or maintaining ISO/IEC 27001 certification, a DPIA complements that work well — the risk assessment required for an information security management system and the risk analysis required for a DPIA cover overlapping ground, and doing both together is usually more efficient than treating them as separate projects.
Getting started
If you're not sure whether your organisation's data processing crosses the threshold, that's a reasonable starting question for a short conversation — we can usually tell fairly quickly whether a full DPIA is warranted or whether a lighter data protection policy review covers what you need.