Organisations that use individuals’ personal data for their own benefit risk prosecution for breaching the Data Protection Act of 2019.

Office of Data Protection Commission head Immaculate Kassait (pictured) warned those breaching the Act by using people’s data without their consent that they risked a Sh5 million fine or six months imprisonment, or both.

Kassait made the remarks in a speech read on her behalf by Rose Mosero, Deputy Data Commissioner-In-Charge of Enforcement and Compliance, during a sensitisation forum on the Data Privacy and Protection Act in Kirinyaga County.

Kassait said people should give consent before their personal data is used by organisations, individuals, or any group in Kenya or outside the country, adding that those handling personal data must be registered with the commission.

She appealed to county commissioners and other law enforcement officers to assist her office in identifying individuals or organisations breaching the Act.

“The categories allowed to manage personal information should be registered with ODPC; they are data controllers and data processors,” she said.

Kassait said since the Commission was established in 2020, they had received more than 2,800 claims from people who feel their data was wrongfully handled.