All templatesDATA PROCESSING AGREEMENT
THIS AGREEMENT is made on 1 October 2026.
BETWEEN:
(1) AFYA BRIDGE CLINICS LIMITED, of P.O. Box 20110-00200, Nairobi (the Controller); and
(2) SAVANNA CLOUD SERVICES LIMITED, of P.O. Box 9912-00100, Nairobi (the Processor).
RECITALS
(A) The Controller wishes the Processor to process personal data on its behalf.
(B) The Act requires that processing to be governed by a written contract, and the parties have agreed the terms of this Agreement.
IT IS AGREED as follows:
1. Definitions
1.1 In this Agreement, unless the context otherwise requires:
(a) Act means the Data Protection Act, 2019;
(b) Business Day means a day other than a Saturday, a Sunday or a public holiday in Kenya;
(c) Controller Data means the personal data described in the Scope of Processing clause that the Processor processes for the Controller; and
(d) Data Commissioner means the Data Commissioner appointed under the Act.
1.2 The terms 'personal data', 'processing', 'data subject' and 'personal data breach' have the meanings given to them by the Act.
2. Scope of Processing
2.1 The Controller Data comprises the categories of personal data, the data subjects, the purpose of processing and the duration of processing set out in the table below.
Item Detail
Categories of personal data Patient names, national ID numbers, dates of birth, contact details, appointment history and billing records
Data subjects Patients and staff of the controller's twelve Nairobi clinics
Purpose of processing Hosting, backup and technical support of the controller's clinic management system
Duration of processing 3 years from the effective date
2.2 The Processor shall process the Controller Data only for the purpose set out in the table.
2.3 The Processor shall process the Controller Data only for the duration set out in the table, being a duration of 3 years from the effective date.
2.4 The Processor shall not process the Controller Data for any purpose of its own.
3. Processor's Obligations
3.1 The Processor shall process the Controller Data only on the written instructions of the Controller and shall notify the Controller immediately if, in the Processor's opinion, an instruction infringes the Act or any other written law.
3.2 The Processor shall not use the Controller Data for any purpose of its own.
3.3 The Processor shall, in processing the Controller Data, be bound by the obligations that the Act places on the Controller.
3.4 The Processor shall ensure that every person it authorises to process the Controller Data is bound to keep that data confidential and complies with the security measures set out in this Agreement.
3.5 The Processor shall give the Controller the information the Controller reasonably needs to demonstrate that the Controller Data is being processed in compliance with the Act.
4. Security
4.1 The Processor shall keep the Controller Data secure against unauthorised or unlawful processing and against accidental loss, destruction or damage.
4.2 The Processor shall apply at least the following security measures:
(a) AES-256 encryption at rest and in transit;
(b) role-based access controls;
(c) annual penetration testing;
(d) ISO 27001-certified data centres.
4.3 The Processor shall review those measures regularly and shall not reduce their strength below that stated in clause 4.2 without the Controller's prior written consent.
5. Sub-Processing
5.1 The Processor may engage a sub-processor to process the Controller Data only with the Controller's prior written approval, and only a sub-processor the Controller has so approved may be engaged.
5.2 The Processor shall bind each sub-processor it engages, in writing, to the same obligations as this Agreement places on the Processor, including the obligations on confidentiality, security, breach notification, data-subject rights assistance and return or deletion.
5.3 The Processor remains liable to the Controller for the performance of the obligations under this Agreement by any sub-processor it engages, and for any act or omission of that sub-processor as if it were the Processor's own.
5.4 The Processor shall give the Controller written notice of any change to the sub-processors it uses, and the Controller may withdraw its approval of a sub-processor on reasonable written grounds, in which case the Processor shall cease to use that sub-processor for the Controller Data.
6. Cross-Border Transfers
6.1 The Processor may transfer the Controller Data to Ireland only for the purpose of processing described in clause 2 and only while the safeguards the Act requires for a transfer of personal data out of Kenya are in place.
6.2 The Processor shall give the Controller the information the Controller needs to show those safeguards to the Data Commissioner, and shall co-operate with any review by the Data Commissioner of the transfer.
6.3 The Processor shall make no other transfer of the Controller Data out of Kenya without the Controller's prior written consent.
7. Personal Data Breaches
7.1 The Processor shall notify the Controller of any personal data breach affecting the Controller Data without delay and, where reasonably practicable, within forty-eight hours of becoming aware of it.
Privacy and data
Data processing agreement template (Kenya)
Also called: Data Processing Agreement (DPA)
What it is for
When another company handles personal data for your business.
The Kenyan law it follows
- Data Protection Act 2019 — s.41 (data protection by design or by default), s.42 (written contract between controller and processor; processor acts only on instructions and is bound by the controller's obligations), s.43 (processor notifies controller of a breach without delay and where reasonably practicable within forty-eight hours), ss.48-49 (transfer of personal data out of Kenya)
- Data Protection General Regulations 2021
- ODPC registration regulations
Who prepares it
You can prepare this yourself. It is still wise to have an advocate read it before you sign, especially where a lot of money or a long commitment is involved.
Fill this in with your own details
Answer a few questions and Lex prepares the document for you, ready to download in Word. A free account is needed.
Sample data processing agreement
The first part of the sample is shown here. The names, amounts and facts are made up to show how the document reads.
The rest of this data processing agreement is for Lex members
Create a free account to read the whole sample, fill it in with your own details and download it in Word.
This is a sample for general information. It is not legal advice and may not suit your situation. Laws change, and a document has to fit your own facts; have an advocate check it before you rely on it.