Section 26 of the Kenya DPA establishes comprehensive data subject rights closely modelled on EU GDPR. (1) Section 26 Seven Data Subject Rights: (a) Right to be Informed of use of personal data; (b) Right of Access - request access to personal data; (c) Right of Correction (Rectification) - correct false or misleading data; (d) Right of Erasure (Right to be Forgotten) - request deletion or destruction of personal data; (e) Right to Object - object to processing including profiling for direct marketing + legitimate interests + public interest task; (f) Right of Restriction - restrict processing in specific circumstances; (g) Right to Data Portability - structured + commonly used + machine-readable format. (2) Section 27 Right of Access Detail: (a) Confirmation whether processing personal data; (b) Copy of personal data; (c) Supplementary information (purposes + categories + recipients + retention + rights + automated decision-making + cross-border transfers); (d) Response within 30 calendar days from receipt of request; (e) Extension possible for complex requests with notification; (f) Free for first request per 12-month period; (g) Reasonable fee for additional or excessive; (h) Refusal grounds limited - state secrets + criminal investigation + national security + third party rights + manifestly unfounded. (3) Section 25 Right of Correction (Rectification): (a) Right to correct inaccurate data; (b) Right to complete incomplete data; (c) 30-day response timeline; (d) Notification to recipients of correction; (e) Reasoned refusal + appealable to ODPC. (4) Section 40 Right of Erasure (Right to be Forgotten): (a) Right to erasure on grounds of (i) no longer necessary; (ii) consent withdrawn; (iii) objection upheld; (iv) unlawful processing; (v) statutory obligation; (vi) child consent revocation; (b) 30-day response timeline; (c) Notification to recipients; (d) Restrictions per legal preservation + state interests + freedom of expression. (5) Section 36 Right to Object: (a) Right to object to processing including profiling for (i) public interest task; (ii) legitimate interests; (b) Controller must stop unless compelling legitimate grounds OR for establishment/defence of legal claims; (c) Absolute right to object to direct marketing including profiling; (d) Absolute right to object to scientific/historical research/statistical that does not involve public interest task. (6) Section 35 Right Not to Be Subject to Automated Decision-Making + Profiling: (a) Right not to be subject to decision based solely on automated processing including profiling which produces legal effects or significantly affects; (b) Exceptions - explicit consent + contract performance + legal authorisation with safeguards; (c) Mandatory safeguards including human intervention + ability to express views + ability to contest decision; (d) NO solely automated decisions based on sensitive data (Section 44) except explicit consent or substantial public interest. (7) Section 38 Right to Data Portability: (a) Right to receive personal data in structured + commonly used + machine-readable format; (b) Right to transmit to another controller; (c) Applies where processing based on consent or contract + carried out by automated means; (d) Does NOT apply to processing for public interest task; (e) Not to the right or freedoms of others. (8) Subject Rights Mechanism Requirements: (a) DSAR portal + identity verification proportionate to risk; (b) Workflow + ticketing + SLA tracking; (c) Audit trail of requests + decisions + actions; (d) Downstream propagation to recipients + sub-processors; (e) DPO oversight + escalation; (f) ODPC appeal; (g) Court action under Section 65 for compensation. (9) Refusal Grounds + Limitations: (a) National security + KDF Kenya Defence Forces + NIS National Intelligence Service; (b) Crime prevention + investigation + prosecution; (c) Tax administration; (d) Judicial independence + proceedings; (e) Defence of legal claims; (f) Manifestly unfounded + excessive frequency. (10) Practical Implementation: (a) DSAR portal in English + Kiswahili; (b) Identity verification - National ID + Huduma Namba + biometric option; (c) 30-day response SLA tracking; (d) DPO oversight + escalation; (e) Customer service surge handling; (f) ODPC reporting + transparency report. (11) Penalties for Rights Violations: (a) Section 63 administrative penalties for failure to enable rights; (b) ODPC escalation; (c) Civil compensation per Section 65; (d) Reputational + customer trust damage. Coordinates with EU GDPR Articles 12-22 + UK DPA 2018 + Convention 108+ + Kenya Constitution Article 31 + Article 35 Access to Information Act 2016 + Section 25 + 26 + 27 + 35 + 36 + 38 + 40 + 65 + Huduma Namba + Constitutional petition. Kenya DPA Data Subject Rights + Sections 26 + 35-40 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.