Somewhere in your business there is a list of people.
It might be a customer database. It might be a spreadsheet of parents and their phone numbers, a book of tenants, patient files, or just the contacts in the shop's WhatsApp. Whatever form it takes, that list is personal data, and since 2019 Kenya has had a law about how it must be treated.
Many business owners assume the Data Protection Act is aimed at banks and telcos. It is not. It applies to almost anyone who collects information about people in the course of business.
We are software people, not lawyers, and for anything specific you should speak to one. But we build systems that hold this kind of information every day, so here is the practical view.
What the law is trying to do
The idea behind the Act is simple: information about a person belongs to that person. A business that holds it is looking after it on their behalf.
From that come a few plain expectations.
- Collect only what you need, and be clear about why you need it.
- Use it for the purpose you gave and not for something else.
- Keep it accurate, and do not hold on to it longer than necessary.
- Keep it safe from loss and from people who should not see it.
- Let people see what you hold about them, correct it and, in many cases, ask you to delete it.
None of that is unreasonable. It is roughly how you would want a business to treat your own details.
Do you need to register?
The law is overseen by the Office of the Data Protection Commissioner, the ODPC. Businesses that handle personal data are expected to register with it as data controllers or data processors.
There is an exemption for very small businesses, based on annual turnover and number of employees. It does not apply across the board, though. Certain sectors, including health and education, are expected to register whatever their size.
The thresholds and the list of sectors are published by the ODPC and can change, so check the current position on their website or with an advisor. Do not assume you are too small to be covered.
Where businesses usually go wrong
In our experience it is rarely deliberate. It is habit.
- A customer list is shared in a staff WhatsApp group, where it stays long after people have left the company.
- Everyone logs in with the same password, so there is no way of telling who looked at what.
- Phone numbers collected for deliveries are later used for marketing messages nobody agreed to receive.
- Old records are never removed, because nobody is sure whether they are still needed.
- A laptop holding the only copy of everything is carried home every evening.
Each of these is a risk to the people on the list, and so a risk to you. Complaints to the ODPC can lead to penalties, and losing customers' trust costs more than any fine.
How a proper system helps
Good software will not make you compliant by itself. It does make the right behaviour the easy one.
- Individual logins. Each person has their own account, so access is personal and can be removed the day someone leaves.
- Roles and permissions. A cashier does not need to see every customer's history. A teacher does not need fee records. People see what their job requires.
- A record of activity. The system keeps track of who viewed or changed what. If something goes wrong, you can find out what happened.
- Backups. Your data is copied automatically, so a stolen laptop is an inconvenience and not a disaster.
- Clean deletion. When someone asks to be removed, or a record is no longer needed, it can be found and dealt with properly.
These are standard in the business systems we build. A school, a clinic or a property agent should not have to think about them as extras.
Five things you can do this week
You do not need a project to make a start.
- Write down what personal information you collect and where it is kept. Most businesses have never listed it.
- Stop sharing customer lists in chat groups and by email.
- Give every member of staff their own login, and remove the ones that belong to people who have left.
- Check that you are backing up, and that you could actually restore from that backup.
- Find out from the ODPC whether you are required to register.
Treat customer data the way you would want yours treated. Most of the law follows from that.
The bigger picture
Customers are paying more attention to this than they used to. A business that can say, plainly, "here is what we hold, here is why and here is how we keep it safe" has an advantage over one that cannot.
Seen that way, data protection is not only a rule to satisfy. It is part of being a business people are comfortable dealing with.
If you are unsure how well your current setup protects the information you hold, talk to us. It is usually a short conversation, and a useful one.
