Learning Outcomes:

1. Identify sensitive personal data classes relevant in Kenya (e.g., health, biometric, genetic, children) and map heightened duties to each class

2. Assess processing scenarios for high-risk indicators (scale, systematic monitoring, new technologies) and flag DPIA requirements

3. Determine legal thresholds that change obligations (e.g., child data processing, large-scale processing, automated decision-making) and document control responses

4. Evaluate purpose compatibility when repurposing data and record outcomes with justification

5. Prioritize safeguards such as pseudonymization, encryption, and access segregation proportionate to sensitivity and risk

6. Draft a decision log that captures classification determinations, high-risk triggers, and consequent safeguards

7. Validate scenario analyses with peer review against statutory criteria and ODPC guidance

Learning Targets:

1. Compile a RoPA containing purposes, categories of data and subjects, recipients, cross-border flows, retention periods, and security measures per regulatory requirements.

2. Produce data flow diagrams for critical processes that trace collection, storage, processing, sharing, and disposal locations.

3. Draft layered privacy notices and just-in-time notices that meet mandatory disclosure elements and provide clear contact/DPO details.

4. Establish a documented retention and disposal schedule aligned to legal, regulatory, and business needs, and implement deletion workflows.

5. Define DPO responsibilities and governance forums with escalation paths and reporting cadence to senior leadership.

Modules

Learning Targets:

1. Execute a DPIA using ODPC-aligned templates, scoping high-risk processing (e.g., sensitive data, large-scale monitoring, new technologies).

2. Elicit and document risks to data subjects, rate likelihood and impact with a calibrated scoring model, and derive residual risk.

3. Select and specify mitigations (minimization, pseudonymization, aggregation, encryption, purpose limitation, access segregation) mapped to identified risks.

4. Determine whether prior consultation with the ODPC is required and prepare the consultation dossier where residual risk remains high.

5. Record DPIA decisions, approvals, and review cycles in a controlled repository for auditability.

Modules

Learning Targets:

1. Implement least-privilege RBAC within IAM, enforce MFA for privileged access, and conduct periodic access reviews.

2. Apply strong encryption for data at rest and in transit; manage keys, rotation, and storage using a KMS and documented cryptographic standards.

3. Configure DLP policies to prevent unauthorized exfiltration of personal data and monitor anomalies via SIEM with defined alert thresholds.

4. Establish secure backup, recovery, and continuity procedures; test restoration for systems holding personal data against defined RPO/RTO targets.

5. Define and enforce secure development and change control practices, including code reviews and data masking in test environments.

Modules

Learning Targets:

1. Implement an authenticated DSAR intake, identity verification, and case management workflow with standardized responses and escalation steps.

2. Locate and consolidate a data subject’s records across systems to fulfill access, correction, erasure, portability, objection, and restriction requests within statutory timelines.

3. Engineer consent capture, refresh, and withdrawal mechanisms that meet validity requirements and record granular purposes.

4. Maintain an auditable consent and rights ledger with timestamps, provenance, decisions, and data disclosed or deleted.

5. Apply enhanced safeguards for children’s data, including age assurance and parental/guardian consent where required.

Modules

Learning Targets:

1. Inventory processors and sub-processors and conduct risk-based due diligence covering privacy and security controls.

2. Draft and negotiate data processing agreements with mandatory clauses (processing instructions, confidentiality, security, sub-processing controls, assistance with rights/DPIAs/breaches, deletion/return).

3. Evaluate cross-border transfers and select appropriate mechanisms (adequacy determinations, ODPC-approved contractual clauses or other appropriate safeguards) and obtain approvals where required.

4. Complete and maintain transfer impact assessments documenting legal, technical, and organizational safeguards and residual risks.

5. Monitor vendors’ ongoing compliance through attestations, audits, and remediation tracking.

Modules

Learning Targets:

1. Activate a personal data breach playbook to classify incidents, contain threats, and coordinate cross-functional response within defined SLAs.

2. Assess risk to data subjects and decide on notifications to the ODPC and affected individuals within required timeframes.

3. Prepare regulatory notifications and communications with required content elements and secure internal approvals prior to submission.

4. Preserve forensic evidence, conduct root cause analysis, and track corrective and preventive actions to closure.

5. Compile an investigation dossier and readiness pack (RoPA, DPIAs, policies, training evidence) to support ODPC audits or inquiries.

Modules