In this episode of PrivacyRules Espresso, Alessandro Di Mattia is joined by Catherine Kariuki Mulika of Cavendrys to discuss Kenya’s new guidance on cross-border transfers of personal data and its implications for multinational organizations operating in Kenya and across East Africa.
Issued by Kenya’s Office of the Data Protection Commissioner, the Guidance comes at a time when the country is seeking to balance data sovereignty with the expansion of regional and continental digital trade under the East African Community (EAC) and the African Continental Free Trade Area (AfCFTA).
Key topics discussed in this episode include:
- The role of Kenya’s Cross-Border Data Transfer Guidance within East Africa’s digital integration agenda;
- Whether compliance with the EU General Data Protection Regulation (GDPR) is sufficient for organizations operating in Kenya;
- The impact of the Guidance on international data transfer arrangements and contracts;
- Personal data breach reporting considerations for multinational organizations;
- The practical measures businesses and their advisers should prioritize when operating in Kenya and across the wider region.
Catherine also explains why organizations transferring personal data outside Kenya should assess their governance frameworks, contractual safeguards and incident-response procedures against local legal requirements, rather than relying solely on global or GDPR-based compliance programmes.
This episode offers practical insights for privacy, legal and compliance professionals seeking to understand Kenya’s evolving data protection framework and manage cross-border transfers of personal data more effectively.