A board-level, self-assessment instrument prepared by Muchangi Patrick & Associates Advocates — 24 scored requirements, a compliance score band, and a priority action plan.
For each requirement below, record one of four ratings: YES — fully compliant; PARTIAL — a defined gap remains; NO — the requirement is unmet; N/A — not applicable to the organisation's operations. Download the fillable PDF to complete and retain your assessment.
Executive Summary
Section 31 of the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 require a Data Protection Impact Assessment ("DPIA") to be carried out before undertaking processing that is likely to result in a high risk to the rights and freedoms of data subjects, including new technologies, large-scale processing, systematic monitoring and profiling. This checklist has been prepared by Muchangi Patrick & Associates Advocates to guide organisations through the screening, assessment and documentation stages of a DPIA, from threshold identification to sign-off and periodic review.
How to Use This Checklist
This checklist is a diagnostic tool, not a substitute for legal advice. Organisations identifying material gaps should seek a full compliance audit before relying on the results for governance or regulatory reporting purposes.
Dpia Screening & Assessment
| No. | Requirement | Yes | Partial | No | N/A |
|---|---|---|---|---|---|
| 01 | Screening assessment conducted to determine whether a DPIA is required | ☐ | ☐ | ☐ | ☐ |
| 02 | Processing involves new technologies or novel uses of personal data | ☐ | ☐ | ☐ | ☐ |
| 03 | Processing involves large-scale processing of personal data | ☐ | ☐ | ☐ | ☐ |
| 04 | Processing involves systematic monitoring of a publicly accessible area | ☐ | ☐ | ☐ | ☐ |
| 05 | Processing involves special (sensitive) categories of personal data at scale | ☐ | ☐ | ☐ | ☐ |
| 06 | Processing involves profiling or automated decision-making with legal or significant effects | ☐ | ☐ | ☐ | ☐ |
| 07 | Processing involves personal data relating to children | ☐ | ☐ | ☐ | ☐ |
| 08 | Processing involves matching or combining datasets from different sources | ☐ | ☐ | ☐ | ☐ |
| 09 | Processing involves transfer of personal data outside Kenya | ☐ | ☐ | ☐ | ☐ |
| 10 | Nature, scope, context and purposes of the processing described | ☐ | ☐ | ☐ | ☐ |
| 11 | Necessity and proportionality of the processing assessed | ☐ | ☐ | ☐ | ☐ |
| 12 | Data minimisation principles applied to the processing design | ☐ | ☐ | ☐ | ☐ |
| 13 | Risks to the rights and freedoms of data subjects identified | ☐ | ☐ | ☐ | ☐ |
| 14 | Likelihood and severity of identified risks assessed | ☐ | ☐ | ☐ | ☐ |
| 15 | Measures to mitigate identified risks documented | ☐ | ☐ | ☐ | ☐ |
| 16 | Data Protection Officer consulted on the assessment (where applicable) | ☐ | ☐ | ☐ | ☐ |
| 17 | Views of data subjects or their representatives sought (where appropriate) | ☐ | ☐ | ☐ | ☐ |
| 18 | Processors and third parties involved in the processing identified | ☐ | ☐ | ☐ | ☐ |
| 19 | Technical and organisational security measures assessed and documented | ☐ | ☐ | ☐ | ☐ |
| 20 | Residual risk after mitigation evaluated | ☐ | ☐ | ☐ | ☐ |
| 21 | DPIA outcome and recommendations documented in a formal report | ☐ | ☐ | ☐ | ☐ |
| 22 | Senior management or data controller sign-off obtained | ☐ | ☐ | ☐ | ☐ |
| 23 | Prior consultation with the ODPC undertaken where high residual risk remains | ☐ | ☐ | ☐ | ☐ |
| 24 | DPIA scheduled for periodic review or review upon material change to processing | ☐ | ☐ | ☐ | ☐ |
Compliance Score
Aggregate the ratings above to determine the organisation's overall compliance posture:
| Score | Assessment |
|---|---|
| 22 – 24 | Excellent |
| 17 – 21 | Good |
| 10 – 16 | Fair |
| 0 – 9 | Immediate Remediation Required |
Priority Action Plan
Corrective actions identified during the assessment should be recorded and tracked to closure, assigned by priority (High / Medium / Low) to a named responsible officer with a target date — see the fillable PDF for a ready-made tracking table.
Overall Assessment
Record an overall rating of Excellent, Good, Moderate/Fair or Poor, together with the auditor's notes, in the space provided in the fillable PDF.