{"id":195735,"date":"2026-07-19T18:14:41","date_gmt":"2026-07-19T16:14:41","guid":{"rendered":"https:\/\/factorialhr.com\/blog\/?p=195735"},"modified":"2026-07-19T18:19:37","modified_gmt":"2026-07-19T16:19:37","slug":"data-protection-act","status":"publish","type":"post","link":"https:\/\/factorial.ke\/blog\/data-protection-act\/","title":{"rendered":"Data Protection Act & HR Systems:Why Your Excel Sheet Is a Compliance Risk"},"content":{"rendered":"

HR teams have quietly become custodians of some of the most sensitive personal data in the country \u2014 national ID numbers, medical records, next-of-kin details, bank accounts, even biometric clock-in data. Under the Data Protection Act, 2019<\/strong>, that makes every HR department a data controller, whether they’ve thought of themselves that way or not.<\/p>\n

For executives responsible for compliance, 2026 is when this stopped being theoretical.<\/p>\n

The Data Protection Act Is No Longer a Paper Tiger<\/strong><\/h2>\n

If your mental model of the Kenyan<\/strong> Data Protection Act<\/strong> is “a law that exists but isn’t really enforced,” it’s time to update it. The Office of the Data Protection Commissioner (ODPC) determined roughly 96\u2013127 complaints in 2025<\/a>, bringing the cumulative total to around 357 determinations and 20 penalty notices since the Act came into force.<\/p>\n

Total fines have exceeded KES 26 million<\/a>, alongside 184 compensation orders that pay damages directly to affected individuals \u2014 some awards reaching KES 500,000 per person through 2024. Under Section 63, the Data Commissioner can impose administrative penalties of up to KES 5 million, or 1% of annual turnove<\/a>r \u2014 whichever is lower.<\/p>\n

Data Protection Act Compliance: Excel Sheets vs. Purpose-Built HR Architecture<\/h2>\n

Most teams don’t compare these two side by side until something goes wrong. Here’s what the gap actually looks like under the Data Protection Act’s core requirements:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
Requirement (Data Protection Act)<\/strong><\/td>\nExcel Sheet \/ Shared Drive<\/strong><\/td>\n\u00a0DPA-Compliant HR Architecture<\/strong><\/td>\n<\/tr>\n
Consent tracking<\/td>\nNo record of what an employee agreed to, or when.<\/td>\nDocumented, timestamped consent per data use.<\/td>\n<\/tr>\n
Data retention limits<\/td>\nFiles kept indefinitely by default – a direct violation.<\/td>\nConfigurable auto-retention (e.g. 6\u201312 months) with scheduled erasure.<\/td>\n<\/tr>\n
Access control<\/td>\nAnyone with the file link can open it \u2014 no permission tiers.<\/td>\nRole-based access; only authorised users see sensitive fields.<\/td>\n<\/tr>\n
Audit trail<\/td>\nNo log of who viewed, edited, or shared the file.<\/td>\nFull activity log \u2014 who accessed what, and when.<\/td>\n<\/tr>\n
Breach detection & 72-hour notification<\/td>\nBreach may go unnoticed for weeks.<\/td>\nCentralised system flags anomalies; supports fast, documented response.<\/td>\n<\/tr>\n
Data subject access requests<\/td>\nManual search across scattered files, slow and error-prone.<\/td>\nStructured records make retrieval and response straightforward.<\/td>\n<\/tr>\n
Backup & version integrity<\/td>\nOne corrupted or lost file can mean permanent data loss.<\/td>\nCloud-based redundancy and version history.<\/td>\n<\/tr>\n
Cross-border transfer safeguards<\/td>\nNo mechanism to verify or restrict where data travels.<\/td>\nGoverned data flows aligned to Section 48 transfer requirements.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The pattern is consistent: Excel wasn’t built to answer the questions the Data Protection Act<\/a> asks \u2014 who consented, for how long, who accessed it, and how fast can you prove it. Spreadsheets have no native way to answer any of those under audit.<\/p>\n

\n
\n
\n

Manage smart working in one click, wherever your team is with Factorial.<\/h4>\n \n

A single place to approve absences, manage your calendar, and communicate with remote employees. Simple, organised, and cloud-based.<\/p>\n \n \n Get a demo <\/a>\n <\/div>\n\n

\n \n <\/div>\n <\/div>\n<\/div>\n

Adopting DPA-Compliant Architecture.<\/strong><\/h2>\n

The table above isn’t hypothetical. It’s the difference between a spreadsheet and a system built to answer the Data Protection Act’s questions on demand. Factorial<\/a> closes that gap with retention controls, permissioned access, and audit trails as standard features.<\/p>\n

Using Factorial is safer than Excel or the mail.\u00a0<\/strong><\/p>\n