Data Protection and Security Policy

This Policy outlines the key standard procedures that must be followed by the different person(s) handling data at different levels in PC Kenya office. It conforms to the Kenya Data Protection Act of 2019 ("the Act"), the Kenya Data Protection (General) Regulations of 2021 ("the Regulations"), and international data protection frameworks, including the European Union General Data Protection Regulation (GDPR), and PC-Kenya’s affiliate, the Population Council, Inc. (PC Inc.) Research Data Security Policy. The object and purpose of this Policy are:

This Policy applies to all PC Kenya employees (including full-time staff and temporary hires), fellows, interns, contractors, vendors, and subaward recipients that are involved in handling of data within or on behalf of PC Kenya. Data includes operations data from Finance and Administration Department (Human Resources and Finance) that mostly handles personnel data as well as research data generated by different projects implemented by PC Kenya. This policy may be used together with other data-related documents such as other standard operating procedures (SOPs) for different components of data collection, management, analysis or sharing.

Article 24 of the Kenya Data Protection Act of 2019 requires a data processor or controller to appoint a Data Protection Officer (DPO). The Data Manager at PC Kenya shall serve as the organization’s DPO. The DPO shall ensure PC Kenya’s compliance with the Kenya Data Protection Law (the Act and the Regulations). This shall include ensuring that the organization’s registration with the Office of the Data Protection Commissioner (ODPC) is up to date and that the DPO’s contacts are communicated to ODPC as required by the Act. The detailed roles and responsibilities of the DPO are outlined in Section 7 of this Policy on "Roles and Responsibilities".

The Data Protection Committee (DPC or "the Committee") at PC Kenya shall comprise a minimum of four individuals and shall include representatives from the Data Management Unit (DMU), Information Technology (IT), Finance, and Human Resource (HR). The Committee shall be responsible for providing oversight on collection, processing, and storage of research and operations data within PC Kenya. The Committee shall further prepare an organizational-wide annual data protection and privacy report that highlights key issues around data protection and security in the organization. The report shall be presented to the Executive Director who shall use it to appraise the PC Kenya Board on matters relating to data protection and security. The detailed roles and responsibilities of the Committee are outlined in Section 7 of this Policy on "Roles and Responsibilities".

PC Kenya data shall be categorized in terms of the level of sensitivity and the potential severity of harm to data subjects resulting from disclosure. Levels of sensitivity shall range from Level 0 (L0 - not sensitive) to Level 3 (L3 - highly sensitive) as defined in the table below. L0 data do not contain personally identifiable information (PII) while L1-3 data contain such information. All PC Kenya employees (including full-time staff and temporary hires), fellows, interns, contractors, vendors, and subaward recipients handling research or operations data on behalf of the organization shall assess the level of sensitivity of such data and the potential severity of impact of disclosure on data subjects based on the criteria outlined below before processing the data. The employee, fellow, intern, contractor, vendor, or subaward recipient shall discuss with the Data Protection Committee the results of the assessment. The Committee shall make a determination of the circumstances under which the data can be processed in a manner that safeguards the data and the data subjects.

In compliance with Part VIII, Section 49(2) of the Kenya Data Protection (General) Regulations of 2021, a Data Protection Impact Assessment (DPIA) shall be conducted before any new research or operations data collection or processing activities within PC Kenya using the DPIA form. The DPIA form shall be completed by Principal Investigators (PIs) of research projects or PC Kenya employees, fellows, interns, contractors, vendors, or subaward recipients handling operations data before initiating new research or data processing activities. The completed form shall be submitted to the Data Protection Committee. The Committee shall make a determination of the actions the PI, employee, fellow, intern, contractor, vendor, or subaward recipient shall take to ensure secure and ethical collection or processing the data. PC Kenya shall also engage the services of external vendors with relevant expertise to conduct organizational-wide DPIA and systems audit once every two years. Based on the review, the vendors shall make recommendations regarding strengthening data protection and security within PC Kenya.

For the purposes of this Policy, data sharing involves making data available to other users or organizations while still retaining ownership. All data shared externally or internally shall have no personally identifiable information (PII). All data must be de-identified before sharing. De-identified research data must be approved by the project lead while operations data must be approved by the Finance and Administration Manager before it is shared externally. This process shall be undertaken for all research after completion of data collection. The PIIs shall also be removed from research data that are shared for analysis, whether analysis is conducted internally or externally. Where PIIs are required to be shared, express approval must be obtained from the data subjects and project Principal Investigator (PI) with written proof that justifies the need for such information. Such data must be shared using secure means and ONLY with the relevant persons authorized to access such data. At NO time shall any research or operations data be shared on social media. Where required that data is posted in public repositories, the data shall be completely anonymized.

For multi-partner projects, a Data Sharing Agreement (DSA) shall be developed outlining the purpose of data sharing, the categories of data involved, and the roles and responsibilities of each party in processing the data. Data may only be shared with third parties under a Data Sharing Agreement (DSA) provided or approved by the authorized individuals.

For the purposes of this Policy, data transfer involves change of ownership and may occur when PC Kenya is required to: (i) submit research data to project implementing partners (or vice versa – sub-award recipients are required to submit data to PC Kenya) or funders as part of contractual obligations; (ii) move research data from one country to another; or (iii) submit organizational data to legal entities in Kenya (e.g., court or the government). Transfer of data from PC Kenya to an implementing partner (or vice versa) shall be guided by contractual or data transfer agreements between the parties. Where such agreements are in contravention of the respective countries’ laws on data transfer, the laws of those countries shall prevail. Transfer of data between countries shall be guided by applicable laws of the countries where data is collected. Transfer of data from PC Kenya to legal entities in Kenya shall require written communication duly signed by a competent officer of the judicial system, such as a magistrate or judge. In all cases, PC Kenya employee, fellow, intern, contractor, vendor, or subaward recipient responsible for overseeing the transfer of data shall work with the Data Protection Committee to ensure proper anonymization, encryption or access control based on the levels of sensitivity defined above before transferring the data.

Electronic data shall be collected using only PC Kenya devices unless otherwise stated in this Policy. All research data collection devices shall be issued to Research Assistants upon signing of agreement forms for the care of equipment and witnessed by PC Kenya authorized staff. By signing the forms, the Research Assistants agree to protect the devices from harmful substances such as fluids or high temperatures. They also agree to make sure the devices are used only for the study purposes and must be returned at the end of the study before they receive their final payments for the work done. They also agree that all data in the devices are kept secure from unauthorized access. All mobile and any handheld devices used for data collection must be returned to PC Kenya immediately and not more than 5 days after data collection is completed. In special circumstances, which must be approved by the Principal Investigators (PIs) or their designates, Research Assistants may be allowed to use their personal devices to collect data that may not have sensitive information. Whether information is sensitive or not must be approved by the study PI or their designates based on the criteria outlined in Section 3.3 of this Policy. In such situations, the data saved in the personal devices MUST be deleted from the devices within 5 days of completion of data collection and upon confirmation by the PC Kenya Data Manager that all data have been submitted and have no obvious errors. The contracted Research Assistants shall be responsible for such deletion, even if the device was borrowed.

Any operations data collected through the Finance and Administration department for organizational processes shall be collected through PC-Kenya official forms and electronically via secure official emails. The emails shall be accessed only through official computers assigned to staff by the IT department which have endpoint and email security to guarantee data security.

Data transmission is the process of sending and receiving paper-based or electronic data from one device or system to another over a communication medium, such as wired (e.g., Ethernet, fiber optics) or wireless (e.g., Wi-Fi cellular) networks. All sensitive data from Level 1 to Level 3 shall be transmitted from any device, either external data collection or storage device like a tablet, recorder, computer or a smart phone only through secure channels approved by PC Kenya IT and Data Management Unit. Before and after the transmission, users shall scan the data for any virus or malware before transmitting to any of the PC Kenya-approved cloud-based platforms or devices. In accordance with the PC Kenya policy on Data Retention (see Section 4.5.1 of this Policy), any data captured on paper (such as consent forms) shall be kept in locked cabinets in PC Kenya office or in the approved warehouse and destroyed after seven years following the end of the project.

For all qualitative data collected on audio or video recorders, the data shall be uploaded on to PC Kenya SharePoint managed by the Data Management Unit and accessed only by the authorized study team members. The data must not be erased from the audio or video recorders in the field. The audios and videos shall not be uploaded on to individual Research Assistants’ computers or other mobile devices except for the instance where the Research Assistant has been contracted to transcribe the data (see Section 4.3 of this Policy on "Data Transcription"). Upon completion of data collection, the audio and video recorders must be returned to the Data Management Unit within 5 days.

Data transcription involves converting information from one format to another, for example, from paper-based to electronic format or from audio or video recordings to electronic format. Data transcription shall only be conducted using software or media approved by PC Kenya. Transcription of audio- or video-recorded data shall ONLY be conducted by PC Kenya contracted Research Assistants or Project Team. Research Assistants may be allowed to use their personal devices to transcribe data that may not have sensitive information. In such situations, the data saved in the personal devices MUST be deleted from the devices within 5 days of completion of data transcription and upon confirmation by the PC Kenya Data Manager that all data have been submitted and have no obvious errors. The contracted Research Assistants shall be responsible for such deletion, even if the device was borrowed.

Transmission of audio or video data shall follow the process outlined under the section on Data Transmission (Section 4.2 of this Policy). All transcripts shall be submitted to the relevant project team members approved by the Principal Investigator to receive such data. Data must be submitted via secure means recommended by PC Kenya IT and the Data Management Unit.

Physical documents that contain PII data shall be kept under lock and key in the PC Kenya premises and the key shall be under the custody of the Principal Investigator for research data documents, and the Finance and Administration department for operations data documents. The documents shall be securely stored in the PC Kenya premises until the time they are transported to the authorized warehouse. All the physical documents moved from the PC Kenya premises to the warehouse and/or vice versa shall be clearly recorded on a data retention/transmission form. A copy of this form shall be shared with the Data Protection Committee for organization documents, or with the Data Protection Committee, the Principal Investigator and thematic area lead for research documents. Electronic data shall be securely stored only on approved cloud-based platforms (e.g., Microsoft365, ODK Central server) and secure access management implemented to ensure that the data is only accessed by authorized users or applications.

PC Kenya recognizes the importance of managing data throughout its entire lifecycle, from initial collection to eventual deletion. This part of the Policy establishes the procedures for both retention and deletion of data in accordance with applicable national laws and regulations in order to optimize the use of storage resources, and mitigate the risks associated with retaining data that is no longer necessary.

All data stored in the PC Kenya cloud-based servers shall be secured by strong passwords, encrypted, with firewall security and restricted access to only the data management team. User access rights configuration shall use role-based access control (RBAC) model while strong password configuration shall be set with strict specification – at least 10 characters long, difficult to guess, taking into account password history and complexity, and password lockout feature where a user shall be locked out of the system if incorrect password is entered 5 consecutive times. User account creation process on the active directory shall be a controlled process. Only authorized personnel shall submit account creation requests to IT through the employee tracker platform. The resources accessed by any account shall be determined by the group under which the account is allocated through RBAC model. Physical documents shall be securely stored under lock and key at the office and in a secure warehouse with only approved personnel authorized to visit and coordinate with the approved warehouse provider regarding storage and destruction of documents.

PC Kenya recognizes the importance of safeguarding the confidentiality, integrity, and availability of data, especially when accessed through mobile devices such as tablets, phones or audio or video recorders. To secure the increasing number of mobile devices used within the organization to collect data, PC Kenya shall implement a Mobile Device Management (MDM) solution for both organization-owned and personal devices that includes measures such as device enrollment, strong passwords, and encryption. Mobile device users must adhere to security configurations and specific guidelines provided for organization-owned and personal mobile devices.

Prior to being used for handling PC Kenya data, all mobile devices MUST be approved and registered by the IT department using a formal process as outlined in the IT standard operating procedures (SOPs). Users are expected to access only necessary data, employ secure connections like VPNs, and avoid unsecured networks. The use of removable media, such as USB drives or memory cards on PC Kenya-owned mobile devices is strongly discouraged. Sensitive work-related data storage on personal devices is strongly discouraged, and when necessary, it must be done in encrypted containers. In the event of a lost or stolen device, users are required to report it immediately to the IT department so that PC Kenya can take the necessary steps to protect the data.

PC Kenya recognizes that the use and adoption of new or emerging technologies including Artificial intelligence (AI) in data processing have grown tremendously and will continue to evolve. The DPC shall conduct a data protection impact assessment (DPIA) to evaluate the risks of processing personal data using new or emerging technologies such as AI before the adoption of such technologies within PC Kenya.

PC Kenya IT shall regularly audit the data systems to determine functionality, review access rights, and address vulnerabilities. PC-Kenya IT shall conduct regular vulnerability assessments and penetration tests and implement patch management to any vulnerabilities identified during these assessments. A systems audit shall also be conducted by external vendors every two years as part of the organization-wide data privacy impact assessment (DPIA) to identify any vulnerabilities that PC Kenya might be exposed to. The external vendors shall prepare a review report with recommendations and submit to PC Kenya IT for action.

Data breach may occur when any section of this Policy, or other governing Country laws on data protection, such as the Kenya Data Protection Act, is violated.

PC Kenya recognizes the importance of upholding data subjects’ rights when processing personal data as an integral component of data safety and security. PC Kenya employees, fellows, interns, contractors, vendors, or subaward recipients MUST uphold data subjects’ rights to the following when processing personal data:

Implementation and monitoring of this Policy shall entail interpreting, assessing, and ensuring compliance with its requirements. The Senior Management Team (SMT) of PC Kenya shall be responsible for providing overall oversight for implementation and monitoring of this Policy. The Data Protection Committee (DPC) shall work closely with the SMT to monitor policy compliance and address any cases of violation through an appropriate incidence response plan which includes assessing the risk, notifying the affected individual and relevant authorities, and implementing proper measures to prevent future incidents. In cases of any policy violations, the concerned employee, fellow, intern, contractor, vendor, or subaward recipient must report such policy violation to the DPC. The DPC shall then conduct investigations to determine if the person is non-compliant. Any employee, fellow, intern, contractor, vendor, or subaward recipient who is determined to be non-compliant shall face appropriate penalties which may include, but are not limited to, denial of access to data, suspension of funding, loss of employment, or legal action.

The PC Kenya IT department and the Data Management Unit shall provide training and sensitization to PC Kenya employees, at least once a year, on existing and/or emerging data protection and security policies and practices in order to foster constant awareness among employees about their roles and responsibilities in ensuring data protection and security. All research assistants involved in research projects shall, prior to being engaged in data collection or being granted access to any sensitive or confidential research data or systems, must undergo training specifically focused on data protection and security, the relevant legal and regulatory requirements (including the Kenya Data Protection Act), and PC Kenya’s data protection and security policies and procedures. The training shall equip the research assistants with the necessary knowledge and skills to handle data responsibly and securely in order to minimize the risk of accidental or intentional data breaches.

All PC Kenya employees, fellows, interns, contractors, vendors, or subaward recipients must acknowledge their understanding and readiness to adhere to this Policy by signing a physical or electronic form upon hiring/engagement and periodically thereafter (annually and/or upon updates) to ensure constant awareness about the organization’s data protection and security guidelines. A signed acknowledgement form shall not be taken to be a contract of engagement between PC Kenya and the concerned individual, but shall serve to confirm the individual’s receipt, understanding, and agreement to the terms of this Policy, their commitment to all guidelines, and their acknowledgement of potential disciplinary and/or legal action for violation of the Policy. Signed acknowledgment forms shall be securely stored by the Human Resources department or the relevant department managing consultant engagements.

Additionally, all research assistants engaged in research projects must sign a legally binding data confidentiality agreement form before being engaged to collect or access data. Signed data confidentiality agreement forms shall serve as an acknowledgement by the research assistants of a clear understanding of their ethical and legal obligations concerning the protection of organizational or research data, and accountability and potential recourse in case of a breach. A clause on data protection and security shall be included in the research assistants’ contracts that are binding during the duration of their engagement in a research project. The Principal Investigators shall take accountability measures against any research assistant who violates the Policy. Violation of the Policy may include committing a data breach, falsifying data or violating ethics requirements pertaining to the research. Accountability measures may include recommending performance improvement, further training, termination of contract for gross misconduct, or having the research assistant reimburse PC Kenya for losses.

This policy shall be reviewed and updated periodically, at least after every three years, to ensure that it remains relevant to evolving technological and legal landscape pertaining to data protection and security in Kenya and/or globally.