Data Subject Rights Notice
At Gitari N. Law Advocates (“the Firm”, “we”, “our”, or “us”), we are committed to protecting your privacy and respecting your rights under the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021, and other applicable laws governing the processing of personal data in Kenya.
As a data controller and, where applicable, a data processor, we process personal information lawfully, fairly, transparently, and only for legitimate purposes. This Notice explains the rights available to individuals whose personal data we process and the procedure for exercising those rights.
Your Rights Under the Data Protection Act
The Data Protection Act grants data subjects several important rights concerning their personal information. These rights are intended to promote transparency, accountability, and individual control over the processing of personal data.
Right to Be Informed
You have the right to be informed about the collection and use of your personal information. This includes information about the categories of personal data we collect, the purposes for which it is processed, the legal basis for processing, the recipients of your information where applicable, and the period for which it will be retained.
Our Privacy Policy and related website notices are intended to ensure that you remain fully informed about our data processing practices.
Right of Access
You have the right to request confirmation as to whether we process your personal information and, where we do, to request access to that information together with details of how it is being processed.
Where permitted by law, we will provide a copy of the personal data we hold about you within the time prescribed by applicable legislation.
Right to Rectification
If you believe that any personal information we hold about you is inaccurate, incomplete, misleading, or outdated, you have the right to request that it be corrected or updated.
Maintaining accurate records enables us to provide effective legal services and meet our professional obligations.
Right to Erasure
You may request the deletion or destruction of your personal information where there is no lawful basis for its continued processing or retention.
Please note that this right is not absolute. As a law firm, we may be required to retain certain records to comply with legal, regulatory, professional, contractual, or evidentiary obligations. We may also retain information where necessary for the establishment, exercise, or defense of legal claims.
Right to Object to Processing
You have the right to object to the processing of your personal information in certain circumstances, particularly where processing is based on our legitimate interests or where your information is used for direct marketing.
Where a valid objection is made, we will cease processing your personal information unless we are able to demonstrate compelling legitimate grounds for continuing the processing or where the law otherwise requires us to do so.
Right to Restrict Processing
You may request that we temporarily restrict the processing of your personal information in circumstances such as where you contest the accuracy of the information, where the processing is unlawful but you oppose its deletion, or where you require us to retain the information for the establishment, exercise, or defense of legal claims.
During any period of restriction, we will continue to store the information but will only process it where permitted by law.
Right to Withdraw Consent
Where we rely on your consent as the lawful basis for processing your personal information, you have the right to withdraw that consent at any time.
Withdrawal of consent will not affect the lawfulness of any processing carried out before the consent was withdrawn, nor will it affect processing carried out on another lawful basis.
Right to Data Portability
Where applicable under the Data Protection Act, you may request a copy of the personal information you have provided to us in a structured, commonly used, and machine-readable format. You may also request that such information be transmitted to another data controller where technically feasible and legally permissible.
Right Not to Be Subject to Certain Automated Decisions
Where applicable, you have the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal effects concerning you or similarly significantly affect you.
Gitari N. Law Advocates does not ordinarily make legal or commercial decisions affecting clients solely through automated processing.
Limitations to These Rights
While we are committed to respecting your rights, certain rights may be limited where restrictions are permitted or required by law.
As a law firm, we owe duties of confidentiality and legal professional privilege to our clients. We are also subject to statutory record-keeping obligations, anti-money laundering and counter-financing of terrorism requirements, court orders, regulatory obligations, and professional duties under the Advocates Act and related legal framework.
Accordingly, we may decline or limit a request where complying with it would:
- breach legal professional privilege or advocate–client confidentiality;
- prejudice ongoing or anticipated legal proceedings;
- conflict with a court order or statutory obligation;
- interfere with the prevention, detection, investigation, or prosecution of criminal activity;
- compromise the rights and freedoms of another individual; or
- otherwise be prohibited under applicable law.
Where we are unable to comply fully with a request, we will explain the reasons, unless prohibited from doing so by law.
How to Exercise Your Rights
If you wish to exercise any of your rights under the Data Protection Act, you may submit a written request to the Firm using the contact details provided below.
To protect your privacy and ensure that personal information is disclosed only to authorised persons, we may request reasonable proof of identity before processing your request. We may also request additional information where necessary to clarify the scope of your request.
We will acknowledge receipt of your request promptly and respond within the timeframes prescribed under applicable law.
Complaints
If you are dissatisfied with the manner in which we have handled your personal information or responded to your request, we encourage you to contact us in the first instance so that we may seek to resolve your concerns promptly and fairly.
If you remain dissatisfied, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) or pursue any other remedy available to you under applicable law.
