Self-Assessment Questionnaire — Entity Portal

COMPLIANCE ASSESSMENT SECTION 8(e) ANNUAL OBLIGATION

Annual Data Protection Self-Assessment Questionnaire

Statutory compliance self-assessment tool pursuant to Section 8(e) of the Data Protection Act, 2019 to ascertain whether information is processed in accordance with the Act and Regulations.

ODPC/REG/2026/004821

Kiboko Bites Ltd

Section 1 of 8: Basic Details Step 1 of 8 (12%)

SECTION 1 — BASIC DETAILS

Name of the Entity*

Type of Data Handler*

Category of Data Handler*

Sector / Industry*

Occupation of Representative Completing Questionnaire*

SECTION 2 — ACCOUNTABILITY & GOVERNANCE

Has your organization developed a Data Protection Policy to guide practices?*

Yes

Plan to

In Progress

Not Applicable

Which of the following documents has your organization developed?

Data Quality Policy to ensure data accuracy

Data Retention Policy determining retention periods for processing activities

Data Anonymisation / Pseudonymisation Policy

Media Destruction and Backup Policy

SECTION 3 — PROCESSING ACTIVITIES & PRINCIPLES

Has your organization identified and documented all processing activities (ROPA)?*

Yes

Plan to

In Progress

Not Applicable

Has your organization described the specific purpose for each processing activity?*

Yes

Plan to

In Progress

Not Applicable

Has your organization determined the lawful basis for each processing activity?*

Yes

Plan to

In Progress

Not Applicable

Which lawful bases does your organization rely on for processing personal data?

Consent — based on permission from the data subject

Performance of a contract — existence of contractual obligations

Legal obligation — compliance with statutory provision

Legitimate Interest — reasonable business reason

Public Interest — reason benefiting public / masses

Research & Statistical purposes — historical or scientific

Where Legitimate Interest is relied on, do you conduct a Legitimate Interest Assessment?*

Yes

Plan to

In Progress

Not Applicable

Where Consent is relied on, has your organization designed consent forms?*

Yes

Plan to

In Progress

Not Applicable

Does your organization align its processing activities to the principles of data protection?*

Yes

Plan to

In Progress

Not Applicable

Which principles of data processing are adhered to by your organization?

Lawfulness, Fairness, and Transparency

Purpose Limitation

Data Minimization

Accuracy

Storage Limitation

Integrity and Confidentiality

SECTION 4 — DATA SUBJECT RIGHTS

Has your organization created and published privacy notices?*

Yes

Plan to

In Progress

Not Applicable

Has your organization established Data Subject Requests Procedures & response templates?*

Yes

Plan to

In Progress

Not Applicable

Which Data Subject Rights are mostly exercised by your data subjects?

Right to be informed

Right to access

Right to object to processing of all or part of personal data

Right to correction of false or misleading data

Right to deletion / erasure of data

None of the above

SECTION 5 — INTEGRITY, CONFIDENTIALITY & BREACH READINESS

Which of the following security policies has your organization developed?

Information Security Policy

Clear Desk and Clear Screen Policy

Acceptable Use Policy

Website Privacy Policy

Bring Your Own Device (BYOD) Policy

Mobile Device and Teleworking Policy

Information Classification Policy

Access Control Policy

Security Awareness Policy

Change Management Policy

Security Incident Response Policy

Vendor Access Policy

Has your organization documented an inventory of all data supporting assets?*

Yes

Plan to

In Progress

Not Applicable

Has your organization identified threats and vulnerabilities for each data asset?*

Yes

Plan to

In Progress

Not Applicable

Has your organization implemented privacy and security controls for each data asset?*

Yes

Plan to

In Progress

Not Applicable

Is your organization aware of the requirement to report data breaches to ODPC within 72 hrs?*

Yes

Plan to

In Progress

Not Applicable

Has your organization reported any data breach incident to the ODPC?*

Yes

Plan to

In Progress

Not Applicable

SECTION 6 — VENDOR (THIRD PARTIES) MANAGEMENT

Does your organization have vendor selection and onboarding procedures?*

Yes

Plan to

In Progress

Not Applicable

Do you ensure each vendor processing data is registered with ODPC as a processor?*

Yes

Plan to

In Progress

Not Applicable

Does your organization conduct periodic privacy and security assessments of vendors?*

Yes

Plan to

In Progress

Not Applicable

SECTION 7 — DATA SHARING & DATA TRANSFERS

Does your organization share personal data with other entities?*

Yes

Plan to

In Progress

Not Applicable

If yes, does your organization sign Data Sharing Agreements (DSAs) with those entities?*

Yes

Plan to

In Progress

Not Applicable

Does your organization transfer personal data outside Kenya (including overseas cloud hosting)?*

Yes

Plan to

In Progress

Not Applicable

Before transfer outside Kenya, do you establish proof of adequate safeguards or obtain consent?*

Yes

Plan to

In Progress

Not Applicable

SECTION 8 — SUBMISSION & DECLARATION

Full Name of Authorized Officer Submitting Questionnaire*

Official Capacity / Designation*

I certify that the responses provided in this self-assessment are true and accurate to the best of my knowledge pursuant to Section 8(e) of the Act.*

The Office of the Data Protection Commissioner (ODPC) appreciates your organization for taking time to undertake the data protection self-assessment exercise.

Cancel