Summary
Kenya adopted the Data Protection Act (DPA) in 2019, fortifying individuals’ right to privacy and strengthening protection of their personal data. The DPA introduced new standards for processing of personal data for which health data is a special category, sensitive personal data. With the continued adoption and use of technology in the Kenyan health sector, it is inevitable that there will be a continued rise in the production and processing of data. Sector specific guidelines on data protection are vital in ensuring the implementation and compliance with the provisions of the act throughout personal data processing activities. This policy brief highlights the existing laws and policies in the health sector, and the extent to which they provide for data protection highlighting the need for sector specific guidelines. It identifies existing policy gaps and makes recommendations on areas that must be considered in the development of data protection guidelines for the health sector in Kenya.
