Statutory Authority & Regulatory Mandate
Cyril Musila Creatives maintains institutional and technical compliance with the Data Protection Act, 2019 (Act No. 24 of 2019) of the Republic of Kenya, promulgated under the oversight of the Office of the Data Protection Commissioner (ODPC).
Where we engage with international clients, cross-border corporate entities, or multinational platforms, our engineering practices simultaneously align with the European Union General Data Protection Regulation (GDPR - Regulation EU 2016/679).
Principles of Data Protection (Section 25)
In accordance with Section 25 of the Kenya Data Protection Act, all personal data processed within our ecosystem conforms to foundational statutory tenets:
- Lawfulness, Fairness & Transparency: Personal data is processed strictly with explicit consent, legitimate interest, or performance of a software development contract.
- Purpose Limitation: Information collected for technical discovery or billing is never diverted to unrelated activities.
- Data Minimization: We engineer our client systems to collect only the minimal data strictly essential for functional operations.
- Accuracy: We maintain mechanisms allowing data subjects to verify and rectify stored records.
- Storage Limitation: Personal identification data is retained only for the duration mandated by commercial and taxation statutes.
- Integrity & Confidentiality: Technical safeguards prevent unauthorized access, alteration, or unlawful processing.
Data Subject Rights under Section 26
Under Section 26 of the Kenya Data Protection Act 2019 and Articles 15–22 of the GDPR, you enjoy enforceable statutory rights as a data subject:
| Statutory Right | Statutory Scope | Fulfillment SLA |
|---|---|---|
| Right to be Informed | Clear disclosure of data collection, processing methods, and controller details. | Immediate via Policy |
| Right of Access | Receive a full machine-readable copy of personal data held in our systems. | Within 14 Business Days |
| Right to Rectification | Correction of outdated, false, or misleading personal information. | Within 7 Business Days |
| Right to Erasure ("To Be Forgotten") | Permanent purging of personal records where statutory retention obligations expire. | Within 14 Business Days |
| Right to Data Portability | Transmission of personal records in structured JSON or CSV format. | Within 14 Business Days |
| Right to Object | Right to prohibit processing for direct marketing or automated profiling. | Immediate |
Client-Side Zero-Knowledge Compliance
Our commitment to data protection is fundamentally engineered into our software architecture:
Data Protection by Design & Default (Section 41)
For custom systems commissioned by our enterprise clients (such as payment gateways, healthcare patient portals, or HR engines), we implement Section 41 Data Protection by Design and Default:
- Automated pseudonymization and column-level encryption in relational databases (PostgreSQL pgcrypto).
- Role-based access controls with strict audit logs recording data inspection events.
- Automated data retention purge routines deleting sensitive logs after statutory time windows.
Mandatory 72-Hour Breach Notification (Section 43)
In the event of a security incident or data breach impacting personal data under our custodial control, Cyril Musila Creatives adheres strictly to Section 43 of the Act:
- Written notification to the Office of the Data Protection Commissioner (ODPC) within seventy-two (72) hours of becoming aware of the incident.
- Immediate direct notification to affected data subjects detailing the nature of the breach, potential risks, and concrete remedial measures deployed.
Cross-Border Data Transfer Safeguards
Under Section 48 and Section 49 of the Act, personal data is transferred across national borders only where:
- The recipient jurisdiction has in place appropriate data protection laws comparable to the Kenyan standard.
- Appropriate standard contractual clauses (SCCs) and binding corporate rules are executed.
- Cloud hosting facilities (e.g. AWS, Cloudflare, Supabase) maintain ISO 27001, SOC 2 Type II, and GDPR compliance certifications.
Data Subject Access Request (DSAR) Protocol
To exercise any of your statutory rights under Section 26, please submit a formal Data Subject Access Request (DSAR) to our compliance desk:
Cyril Musila Creatives — Legal & Data Compliance Desk
Email: info@cyrilcreatives.com (Subject: "FORMAL DSAR REQUEST")
Telephone: +254 723 378 788
Office: Nairobi, Kenya
If you believe your data protection rights have been infringed, you retain the statutory right to lodge a formal complaint with the Office of the Data Protection Commissioner of Kenya (ODPC) at complaints@odpc.go.ke.