Section 30 of the Kenya DPA establishes the lawful basis framework + Section 29 establishes information notice requirements. (1) Section 30 Lawful Basis - 7 Grounds: (a) Consent of data subject; (b) Performance of contract to which data subject is party + or pre-contractual steps requested by data subject; (c) Compliance with legal obligation; (d) Protection of vital interests of data subject or another natural person; (e) Performance of task carried out in public interest or in exercise of official authority; (f) Legitimate interests of controller or third party (subject to balancing against data subject interests); (g) Historical + statistical + journalistic + literary + artistic expression purposes (subject to safeguards). (2) Section 25 Consent Definition: (a) Any manifestation of express + unequivocal + free + specific + informed indication of data subject wishes; (b) Pre-ticked boxes + silence + inactivity do NOT constitute consent; (c) Clear affirmative action required; (d) Bundled consent prohibited; (e) Withdrawable at any time without detriment; (f) Burden of proof on controller to demonstrate consent. (3) Section 32 Form of Consent Specific Rules: (a) Written form for sensitive personal data; (b) Electronic equivalent acceptable per Electronic Transactions and Services Act 2018; (c) Audio-video recording for telephone/online consent; (d) Documented audit trail; (e) Period of validity specified; (f) Withdrawal mechanism + accessibility. (4) Section 33 Children's Consent: (a) Specific protections for children's personal data; (b) Parental + guardian consent for under 18 (Kenya age of majority); (c) Age verification mechanisms; (d) Reasonable steps to verify parental consent; (e) Child-friendly Privacy Notice. (5) Section 44 Sensitive Personal Data Heightened Consent: (a) Explicit consent for sensitive data; (b) Written form required; (c) Specific to sensitive data category; (d) Informed of consequences; (e) Reaffirmation for new purposes. (6) Section 29 Information at Collection (Privacy Notice): (a) Identity of controller + contact details + DPO if applicable; (b) Purposes of processing + lawful basis; (c) Categories of personal data; (d) Recipients + categories of recipients; (e) Cross-border transfer + safeguards; (f) Retention period; (g) Data subject rights + how to exercise; (h) Right to lodge complaint with ODPC; (i) Whether provision is statutory + contractual + voluntary + consequences of failure; (j) Automated decision-making + profiling (Section 35); (k) Plain English + Kiswahili language; (l) Material change notification. (7) Privacy Notice Accessibility Requirements: (a) Reasonably accessible to data subject; (b) Plain language - English + Kiswahili; (c) Conspicuous link; (d) Mobile-friendly; (e) Accessibility for persons with disabilities per ADA-equivalent; (f) Multi-language for foreign data subjects in Kenya. (8) Privacy Notice Update Notification: (a) Material changes notification; (b) Email notification for active customers; (c) Website banner for material changes; (d) Effective date and version history; (e) Archived previous versions accessible. (9) Cross-Border Lawful Basis: (a) Section 48 cross-border transfer requires lawful basis PLUS additional safeguards; (b) Consent must be express for cross-border; (c) Section 49 derogations apply for specific circumstances. (10) Penalties for Lawful Basis + Notice Failures: (a) Section 63 administrative penalties up to KES 5M or 1% turnover; (b) ODPC escalation; (c) Civil compensation; (d) Reputational damage. Coordinates with EU GDPR Articles 5-7 + UK DPA 2018 + Convention 108+ + Kenya Constitution Article 31 + Electronic Transactions and Services Act 2018 + EDPB Guidelines on Consent + Transparency + Children Data + Section 25 + 29 + 30 + 32 + 33 + 35 + 44 + 48-49. Kenya DPA Lawful Basis + Sections 29-30 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.