Recent concerns about data security have led governments to enact protection regulations. In 2019, Kenya enacted its own Data Protection Act, following the EU’s GDPR in 2018. These regulations enforce responsible processing of personal data through lawful processing, data minimization, accuracy, and security safeguards.

This policy provides guidance on how Accurate Steel Limited handles the data it collects. It helps us comply with data protection law, protect the rights of data subjects, and safeguard against risks related to breaches of data protection.

The policy ensures that Accurate Steel Limited protects the rights of data subjects and that all data collection and processing is done in line with required legislation. All staff must comply with this policy; breach of which could result in disciplinary action.

This policy applies to:

Employees of Accurate Steel Limited and all associated parties such as implementing partners, vendors, contractors, and any other third party who handle Accurate Steel Limited information
All personal data processing where Accurate Steel Limited is the ‘Controller’ or ‘Processor’ for the personal data being processed
All formats including printed and digital information, text and images, documents and records, data and audio recordings

1. Lawful, Fair & Transparent Processing
Data is processed lawfully, fairly and in a transparent manner, in line with the right to privacy.

2. Purpose Limitation
Data is collected only for specified, explicit and legitimate purposes and not further processed in a manner incompatible with that purpose.

3. Data Minimization
Data is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

4. Accuracy
Data is accurate and, where necessary, kept up to date.

5. Storage Limitation
Data is not kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data is processed.

6. Security & Integrity
Data is processed in a manner that ensures its security using appropriate technical and organizational measures to protect against unauthorized or unlawful processing and accidental loss, destruction, or damage.

7. Transfer Restriction
Data is not transferred out of Kenya unless there is proof of adequate data safeguards/measures or consent from the data subject.

Data Controller
A natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purpose and means of the processing of personal data.

Data Processor
A natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

Data Subject
An identified or identifiable natural person who is the subject of personal data.

Personal Data
Any information relating to an identified or identifiable natural person.

Personal Data Breach
A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

Sensitive Personal Data
Data that reveals a person’s race, health status, ethnic/social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of children/parents/spouse, sex, or sexual orientation.

Processing Data
Any operation or sets of operations performed on personal data whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, alignment, combination, restriction, erasure or destruction.

Data subjects have the right to:

Be informed of the use to which their personal data is to be put
Access their personal data in Accurate Steel Limited custody
Object to the processing of all or part of their personal data

Correction of false or misleading data
Deletion of false or misleading data about them
Withdraw consent at any time

Accurate Steel Limited has designated the IT Officer to be the Data Protection Officer (DPO).

The DPO will:

Advise staff on requirements for data protection, including data protection impact assessments
Ensure compliance with legal requirements on data protection
Facilitate capacity building of staff involved in data processing operations
Cooperate with external regulators on matters relating to data protection

All staff must:

Read, understand and comply with the contents of this policy
Report suspicions of breaches promptly

All managers must:

Ensure staff and third parties they work with are aware of the contents of this policy
Conduct risk assessments and update controls and procedures to mitigate the risk of data breaches

HR and IT Departments are responsible for ensuring employees, consultants, vendors, and partner organizations are aware of the policy and are supported to implement it.

The Board of Directors provides governance oversight and ensures adequate and effective systems are in place to safeguard data.

Accurate Steel Limited will maintain adequate records to show that consent was obtained before processing personal data. Data will not be processed after the withdrawal of consent by a data subject.

Data Minimization Principles:

We will not process any personal data for a purpose for which we did not obtain consent
We collect and process data that is adequate, relevant, and limited to what is necessary
Staff must not access data which they are not authorized to access
Data must only be collected for the performance of duties and tasks
Staff must delete, destroy, or anonymize any personal data that is no longer needed

Accurate Steel Limited will not process data relating to a child unless consent is given by the child’s guardian or parent and the processing is in a manner that protects and advances the rights and best interests of the child in line with our Safeguarding policy.

We will institute adequate mechanisms to verify age and obtain consent before processing children’s data.

Accurate Steel Limited will process sensitive personal data only when:

The processing is carried out in the course of legitimate activities with appropriate safeguards
The processing relates solely to staff or persons who have regular contact with us
The personal data is not disclosed outside Accurate Steel Limited without consent
The processing relates to personal data made public by the data subject
Processing is necessary for the establishment, exercise or defense of a legal claim
Processing is necessary for carrying out obligations and exercising specific rights
Processing is necessary to protect vital interests where the data subject is physically or legally incapable of giving consent

We will transfer personal data out of Kenya only when we have:

Proof of appropriate measures for security and protection of the personal data
Confirmation provided to the Data Protection Commissioner in accordance with Kenya’s Data Protection Act, 2019
Verification that data is transferred to jurisdictions with commensurate data protection laws
Consent from data subjects for sensitive personal data transfers

Transfers may be necessary for contract performance, matters of public interest, legal claims, or to protect vital interests of data subjects.

Accurate Steel Limited will train staff on the contents and implementation of this policy. Staff who join Accurate Steel Limited will be required to go through an induction process that entails familiarization with this policy.

We ensure that the requirements of this policy form part of our agreement with grantees, contractors and third parties who process Accurate Steel Limited data.

In line with regulatory requirements, Accurate Steel Limited will report to the Data Protection Commissioner any data breach within 72 hours of being aware.

We will also communicate the data breach to the data subject as soon as is practical unless the identity of the data subject cannot be established.

Grantees and partners must report breaches of Accurate Steel Limited data in their custody within 48 hours.

The data retention period in Accurate Steel Limited is determined by legitimate needs. Adequate records of decision making will be maintained to show cause.

Independent Assurance: The adequacy and effectiveness of our data protection procedures is subject to regular internal audit reviews. Where necessary, we may call an external review to provide assurance over the integrity.

Policy Review: The HR Manager is responsible for ensuring this policy is reviewed on a timely basis. This policy will be reviewed every two years and approved by the Board of Directors.

Code of Conduct • Misconduct, Disciplinary and Grievance Policy • Information Security Policy

CONTACT DPO

Search Bar

Data Protection Policy

Lawful Processing

Data Security

Your Rights

Purpose & Scope

Seven Principles of Data Protection

Understanding Data Protection Terms

Rights of Data Subjects

Data Protection Officer & Responsibilities

Special Categories of Data Processing

Training, Breach Reporting & Data Retention

This policy should be read in conjunction with:

Protecting Your Privacy, Ensuring Your Trust

Head Office

Working Hours

Get in Touch

THANK YOU FOR VISITING