Compliance advisory

• Advised a range of clients, including a multinational manufacturing firm, an international educational institution in Kenya, a global professional services accounting firm, and a German multinational chemical manufacturing subsidiary. The advisories have covered a range of issues including: management of a reported data breach; qualification of surveys in a B2B Voice of the Customer project as direct marketing under Kenyan data protection law; data protection laws during the implementation of a global e-filing system for human resources records; compliance during implementation of a transcription feature in the AI Copilot tool; the legal impediments that the company needed to consider when giving consent under the U.S. Sarbanes-Oxley Act of 2002; implementation of a proposed photo consent clause in employee contracts; lawful bases for processing as well as addressing specific exceptions related to the protection of children’s personal data.

Projects

• Provided comprehensive expert advisory to an Irish law firm on legal compliance requirements impacting online minor safety that may apply to TikTok services in Kenya. The advisory also included a comparative study of how social media companies comply with Kenya’s data protection laws regarding the enforcement of parental controls that respect the rights and best interests of children, both of which are legitimate and well-documented.
• Conducted a thorough review of the Data Protection Impact Assessment (DPIA) report related to a project by a global product manufacturing firm on the delivery of a cloud-based ERP system with data processing and storage capabilities.

Litigation and Dispute Resolution

• Part of the legal team that represented and successfully defended the Office of the Data Protection Commissioner (ODPC) in a pivotal court case that challenged the regulator’s determination in ODPC Complaint No. 289 of 2024, Dennis Gitonga Ndururi v. Twiga Foods Limited. The case was successfully defended, demonstrating a skill in safeguarding clients’ interests in complex data protection matters.
• Part of the legal team that represented and successfully defended an international logistics company headquartered in Dubai in a court case filed in Kenya, where the plaintiff alleged violations of standards for protecting the personal data of a customer of parcel shipping and cargo shipping.
• Represented and defended a leading solar service provider/company in a complaint filed with the Office of the Data Protection Commissioner (ODPC). The case involved a strategic advocacy for a reduction in the claim amount from KShs 10,000,000 sought by the Complainant. It also involved facilitating constructive negotiations under the ODPC’s Alternative Dispute Resolution (ADR).
• Represented the Office of the Data Protection Commissioner (ODPC) in a constitutional petition filed by petitioners, who are challenging regulatory decisions and enforcement actions.
• Part of the team that successfully defended a taxpayer in cases before the High Court and the Court of Appeal, with the contested tax value of over Kenya Shillings 380 million.

Data Protection Audits and Impact Assessments

• Part of the team providing consultancy services to the Insurance Regulatory Authority of Kenya, conducting a comprehensive audit of its compliance with the Data Protection Act and its attendant regulations.
• Part of the team providing consultancy services to Platinum Credit Company, conducting a comprehensive audit of their compliance with the Data Protection Act, together with its attendant regulations.
• Part of the team that conducted audits for the Technical University of Mombasa, Kenya Civil Aviation Authority, Kenya Electricity Generating Company, Kenya Power and Lighting Company, BOC Gases Limited, and the National Government Constituency Development Fund Board.
• Part of the team which conducted regulatory impact assessment projects and studies for leading regulators in the agricultural sector, with a total project value of KShs. 10 million.

Training

• Facilitated a highly engaging training on the overview of the Data Protection Act 2019, data protection compliance, day-to-day monitoring of organisational data, impact of the Draft Human Rights Due Diligence Framework for businesses in Kenya, and the role of AI and digitalization in the workplace.  The training sessions were delivered to staff and members of a Charity organization, the staff of a digital credit lending institution, a global red-hailing company, staff at a Sacco, a health and population health center, and the Kenya legal professional’s body. The training has been done in strategic partnership with Training and Consulting Associates (an affiliate of MMK) and the Law Society of Kenya (LSK) in Nairobi. Some of the training sessions are accredited for Advocates under the Continuous Professional Development (CPD) scheme.