Kenya’s Data Protection Act and its jurisdictional reach: governing cross-border data transfers

Abstract

This dissertation examines the jurisdictional reach of Kenya’s DPA in regulating cross border transfers, focusing on its extraterritorial enforcement and compliance. The study evaluates whether the DPA adequately addresses the risks and challenges posed by international data transfers, emphasizing its role in safeguarding the right to privacy. The dissertation also takes a step at critically assessing the Data Protection Act's extraterritorial jurisdiction. Furthermore, the study outlines Kenya’s current legal framework. Evidence of gaps in enforcement and compliance is presented, alongside risks associated with inadequate regulation of cross-border data transfers. The findings underscore the need for policy and legal reforms to enhance the DPA's efficacy. This research offering insights into enhancing the DPA’s jurisdictional reach and fostering data privacy in a globalized digital environment.