Data protection for campaigns
Controller and processor roles, lawful basis, retention and breach duties under Kenyan law.
This page summarises a campaign's main duties under Kenya's Data Protection Act, 2019 and how Sauti helps. It is general information, not legal advice. Work with your own legal adviser.
Who is responsible for what#
| Party | Role | Responsible for |
|---|---|---|
| Your campaign | Data controller | Deciding why and how supporters' data is used, having a lawful basis, answering to supporters and the ODPC |
| Sauti | Data processor | Processing only on your instructions, keeping data secure, helping you meet your duties |
The tenant agreement (Settings › Organization) sets this out formally. Review and sign it with your adviser.
Registration#
Data controllers and processors above the thresholds must register with the Office of the Data Protection Commissioner. Check whether your campaign must register, and keep the certificate current.
Lawful basis and source#
Every list must have a known source and a lawful basis, usually consent or legitimate interest. Sauti records both on import, and keeps the evidence reference. Do not upload lists you cannot account for, such as numbers bought from third parties.
The ODPC's guidance on processing personal data for electoral purposes applies to campaigns. Read it before you start.
Data minimisation#
Collect only what you need. Do not store sensitive personal data such as ethnicity, religion or health, and never create custom fields for it.
Retention#
| Data | Default retention |
|---|---|
| Supporter person and contact records | Campaign end + 90 days, then deleted or anonymised |
| Messages and delivery logs | Campaign end + 12 months |
| Consent and opt-out records | 5 years after last activity |
| Platform suppression hashes | Indefinitely, to keep honouring opt-outs |
| Audit logs | 5 years |
| Financial records | 7 years |
| Uploaded source files | 30 days after import |
Rights requests#
Supporters can request access, correction, objection or erasure. Forward any request you receive to Sauti straight away. See Data subject requests.
Breaches#
If personal data is exposed, the ODPC must be notified within 72 hours of becoming aware, and affected people where required. If you suspect a breach involving Sauti, tell the Sauti team immediately.
Electoral rules#
- Hate speech and incitement are prohibited under the National Cohesion and Integration Act; Sauti screens every message.
- Respect election-silence periods; Sauti blocks promotional sends during them.
- Keep donation records for reporting under the Election Campaign Financing Act; Sauti provides a compliance export.
- Use each sender ID only for its approved purpose.