Section 26 of the Kenya DPA establishes comprehensive data subject rights closely modelled on EU GDPR. (1) Section 26 Seven Data Subject Rights: (a) Right to be Informed of use of personal data; (b) Right of Access - request access to personal data; (c) Right of Correction (Rectification) - correct false or misleading data; (d) Right of Erasure (Right to be Forgotten) - request deletion or destruction of personal data; (e) Right to Object - object to processing including profiling for direct marketing + legitimate interests + public interest task; (f) Right of Restriction - restrict processing in specific circumstances; (g) Right to Data Portability - structured + commonly used + machine-readable format. (2) Section 27 Right of Access Detail: (a) Confirmation whether processing personal data; (b) Copy of personal data; (c) Supplementary information (purposes + categories + recipients + retention + rights + automated decision-making + cross-border transfers); (d) Response within 30 calendar days from receipt of request; (e) Extension possible for complex requests with notification; (f) Free for first request per 12-month period; (g) Reasonable fee for additional or excessive; (h) Refusal grounds limited - state secrets + criminal investigation + national security + third party rights + manifestly unfounded. (3) Section 25 Right of Correction (Rectification): (a) Right to correct inaccurate data; (b) Right to complete incomplete data; (c) 30-day response timeline; (d) Notification to recipients of correction; (e) Reasoned refusal + appealable to ODPC. (4) Section 40 Right of Erasure (Right to be Forgotten): (a) Right to erasure on grounds of (i) no longer necessary; (ii) consent withdrawn; (iii) objection upheld; (iv) unlawful processing; (v) statutory obligation; (vi) child consent revocation; (b) 30-day response timeline; (c) Notification to recipients; (d) Restrictions per legal preservation + state interests + freedom of expression. (5) Section 36 Right to Object: (a) Right to object to processing including profiling for (i) public interest task; (ii) legitimate interests; (b) Controller must stop unless compelling legitimate grounds OR for establishment/defence of legal claims; (c) Absolute right to object to direct marketing including profiling; (d) Absolute right to object to scientific/historical research/statistical that does not involve public interest task. (6) Section 35 Right Not to Be Subject to Automated Decision-Making + Profiling: (a) Right not to be subject to decision based solely on automated processing including profiling which produces legal effects or significantly affects; (b) Exceptions - explicit consent + contract performance + legal authorisation with safeguards; (c) Mandatory safeguards including human intervention + ability to express views + ability to contest decision; (d) NO solely automated decisions based on sensitive data (Section 44) except explicit consent or substantial public interest. (7) Section 38 Right to Data Portability: (a) Right to receive personal data in structured + commonly used + machine-readable format; (b) Right to transmit to another controller; (c) Applies where processing based on consent or contract + carried out by automated means; (d) Does NOT apply to processing for public interest task; (e) Not to the right or freedoms of others. (8) Subject Rights Mechanism Requirements: (a) DSAR portal + identity verification proportionate to risk; (b) Workflow + ticketing + SLA tracking; (c) Audit trail of requests + decisions + actions; (d) Downstream propagation to recipients + sub-processors; (e) DPO oversight + escalation; (f) ODPC appeal; (g) Court action under Section 65 for compensation. (9) Refusal Grounds + Limitations: (a) National security + KDF Kenya Defence Forces + NIS National Intelligence Service; (b) Crime prevention + investigation + prosecution; (c) Tax administration; (d) Judicial independence + proceedings; (e) Defence of legal claims; (f) Manifestly unfounded + excessive frequency. (10) Practical Implementation: (a) DSAR portal in English + Kiswahili; (b) Identity verification - National ID + Huduma Namba + biometric option; (c) 30-day response SLA tracking; (d) DPO oversight + escalation; (e) Customer service surge handling; (f) ODPC reporting + transparency report. (11) Penalties for Rights Violations: (a) Section 63 administrative penalties for failure to enable rights; (b) ODPC escalation; (c) Civil compensation per Section 65; (d) Reputational + customer trust damage. Coordinates with EU GDPR Articles 12-22 + UK DPA 2018 + Convention 108+ + Kenya Constitution Article 31 + Article 35 Access to Information Act 2016 + Section 25 + 26 + 27 + 35 + 36 + 38 + 40 + 65 + Huduma Namba + Constitutional petition. Kenya DPA Data Subject Rights + Sections 26 + 35-40 applies.
This control maps to 25 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 25 it maps to, and the evidence behind each claim, over MCP and REST.