Sections 56-63 of the Kenya DPA establish the complaints + enforcement + penalty framework. (1) Section 56 Right to Complain: (a) Data subject may complain to ODPC against controller or processor; (b) Anonymous complaints accepted at ODPC discretion; (c) Civil society + NGO complaints accepted with subject consent; (d) Commissioner may initiate investigation on own motion. (2) Section 57-58 Investigation + Hearing: (a) Preliminary review + admissibility; (b) Controller/processor invited to respond; (c) Formal investigation with information gathering; (d) Interim orders if urgent; (e) Interview of witnesses; (f) Production of documents; (g) Inspection of premises; (h) Cooperation requirement; (i) Privacy of investigation balanced with transparency. (3) Section 59 Determination + Orders: (a) Finding of non-compliance + nature; (b) Compliance orders; (c) Cessation orders; (d) Corrective measures + specific remediation; (e) Administrative penalty; (f) Public Naming for serious violations. (4) Section 61 + 62 Administrative Penalties: (a) Commissioner power to impose monetary penalties; (b) MAXIMUM KES 5 MILLION OR 1 PERCENT of annual turnover WHICHEVER IS HIGHER per violation; (c) Considerations - (i) nature + gravity + duration; (ii) intentional or negligent; (iii) measures taken to mitigate; (iv) responsibility level; (v) previous infringements; (vi) cooperation; (vii) categories of data; (viii) manner came to ODPC attention; (ix) effect of penalties; (x) other factors; (d) Repeat or aggravated violations may attract maximum; (e) Penalty proceeds to ODPC operating budget. (5) Section 63 Criminal Offences: (a) Unauthorised obtaining + disclosure - up to KES 3 million + 10 years imprisonment; (b) Re-identification without authorisation; (c) Obstruction of ODPC investigation; (d) False/misleading statements; (e) Personal criminal liability for individuals; (f) Reasonable Care defence available. (6) Section 65 Civil Compensation: (a) Data subject right to compensation for material or non-material damage; (b) Suit against controller and/or processor; (c) Joint and several liability of joint controllers; (d) Controller liable for processor breach unless processor solely at fault; (e) Limitation period - 3 years (Limitation of Actions Act); (f) Class action possible per Civil Procedure Code. (7) Director + Officer Liability: (a) Corporate offences attributable to director + officer who consented + connived + neglected; (b) Personal criminal liability; (c) Corporate veil pierced; (d) D and O insurance considerations; (e) Indemnification limits; (f) Personal financial exposure. (8) Appeal Mechanism: (a) Data Protection Tribunal (independent body) - first appeal; (b) High Court of Kenya - judicial review; (c) Court of Appeal - apex appeal; (d) Supreme Court - constitutional questions; (e) Interim relief available; (f) Stay of penalty pending appeal in most circumstances. (9) ODPC Engagement Strategy: (a) Proactive ODPC dialogue; (b) Voluntary breach reporting; (c) Cooperation in investigations; (d) Settlement strategies; (e) Compliance program enhancements; (f) Code of Conduct adoption per Section 63. (10) Cross-Border Enforcement: (a) Commissioner cooperation with foreign DPAs; (b) Memoranda of Understanding; (c) Joint investigations; (d) Mutual legal assistance; (e) Convention 108+ framework; (f) African Union Convention coordination; (g) East African Community coordination. (11) Training + Awareness: (a) Mandatory data protection training for all personnel; (b) Annual refresher training; (c) Role-based specialised training; (d) DPO + privacy team specialised certifications; (e) Customer service training on rights; (f) Vendor training requirements via contract; (g) Documentation of training completion + ODPC requirement. (12) Reasonable Care Defence: (a) Person took all reasonable precautions and exercised all due diligence; (b) Burden on accused; (c) Corporate due diligence systems essential; (d) Documentation of training + policies + procedures; (e) Compliance audit + internal review records. Coordinates with EU GDPR Articles 82-84 + UK DPA 2018 + Convention 108+ + Kenya Constitution + Companies Act 2015 + Civil Procedure Code + Limitation of Actions Act + Kenya Civil Procedure Rules + African Union Convention on Cyber Security and Personal Data + EAC coordination + Data Protection Tribunal + High Court + Court of Appeal + Supreme Court of Kenya. Kenya DPA Complaints + Enforcement + Sections 56-65 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.