Section 35 of the Kenya Data Protection Act, 2019 gives every person a right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects them. The right does not apply where the decision is needed for a contract, is authorised by law with suitable safeguards, or is based on the person’s consent. Where such a decision is made, the organisation must tell the person in writing. The person can then ask it to reconsider, or to take a new decision that is not based solely on automated processing, and must be told in writing what was done.
Regulation 22 of the Data Protection (General) Regulations, 2021 (Legal Notice No. 263) adds detail. Organisations that use automated decision-making must tell people, give meaningful information about the logic involved and its likely consequences, use appropriate statistical methods, correct errors, prevent discriminatory effects and bias, and let people obtain human intervention and give their view. The Office of the Data Protection Commissioner enforces the Act.