Data Protection
Practical data protection counsel — from compliance programmes to regulator engagement and incident response.
Data protection, built for real operations.
The Data Protection Act has reshaped the compliance landscape for institutions of every size. We advise clients on programme design, lawful basis analysis, cross-border transfers, and Data Protection Commissioner engagement.
When incidents happen, we respond fast — coordinating notification, remediation, and communication with discipline.
- Compliance programmes & DPIAs
- Cross-border data transfers
- Data Commissioner engagement
- Breach response & remediation
How we approach this practice.
We advise controllers and processors on end-to-end compliance with Kenya's Data Protection Act — from registration and DPIA methodology to cross-border transfer architecture, breach response, and engagement with the Office of the Data Protection Commissioner.
The full data protection lifecycle.
End-to-end data protection programmes, policies, and controls for regulated and non-regulated firms.
Data Protection Impact Assessments, vendor diligence, and processor arrangements.
Adequacy analysis, standard contractual clauses, and cross-border transfer frameworks.
Incident response, notification obligations, and Data Commissioner engagement.
Handling access, erasure, and objection requests — including complex and vexatious ones.
Registration, ongoing engagement, and enforcement defence with the ODPC.
A disciplined path from concept to close.
- 01Commercial Alignment
We start with the commercial map — economics, control, contributions, and outcome — before drafting a single clause.
- 02Structural Blueprint
A structuring memo sets out the vehicle, jurisdiction, tax treatment, and regulatory path, benchmarked against comparable matters.
- 03Documentation
Bespoke documentation drafted as an integrated instrument set — designed to survive later scrutiny.
- 04Approvals & Closing
Regulator engagement, condition-precedent management, and a disciplined closing choreography.
- 05Stewardship
Ongoing counsel through the life of the matter — governance, calendaring, and dispute-prevention.
Selected data protection mandates.
A partial view of the mandates we have advised on — sanitised for confidentiality, but indicative of the scale and complexity of our work.
- 01
Delivered a data protection compliance programme for a listed regional financial institution.
- 02
Advised a global technology group on cross-border data transfer architecture into Kenya.
- 03
Represented a client through a Data Commissioner-led investigation.
- 04
Led incident response and notification for a mid-market business following a data breach.
Partners leading the practice.
Where this work connects.
Considering a matter? Speak with the partner who will run it.
A confidential, no-obligation conversation with a partner — usually within one business day.