Over the weekend, we had the pleasure of hosting professionals from the legal industry; Lawyer Linda Bonyo, co-founder at Lawyers Hub Kenya and legaltech enthusiast, Mercy King’ori who blogs at Legalhub and works with CIPIT. Both led us through an in-depth discussion on law and digital business.
The goal of the discussion was to inform and educate business owners, marketers, as well as developers of the risks and opportunities created by Kenyan laws like the Computer and Cyber Crimes law, Intellectual property laws and data protection bill.
However, in this article we would like to focus on the upcoming Kenya data protection bill and what it means for your website. According to the bill presented by Gideon Moi, chairperson of the ICT committee, a business has the legal obligation to inform its users if they are collecting their data, how they plan to use the data collected and how long they will store the data. But that’s not all, the law also gives individuals the right to refuse to have their data collected and requires businesses to edit or delete an individuals data upon request.
Fortunately, unlike the GDPR which threatens a penalty of 20 million Euros or 4 percent of annual global turnover, the Kenya Data protection bill imposes a fine not exceeding Ksh. 500,000 or two years of imprisonment , or both for any individual found guilty of mishandling personal data. The bill does not mention fines or penalties for corporations that are found guilty of the same.
Closer to your Website
Let’s first agree, that including data protection measures on your website should not be all about skirting the penalties associated with the Kenya Data Protection law, instead it’s about improving the experience and trust with your website visitors. After all, no visitors no business. That said, let’s get down to business. How do you develop and design a website with data protection and privacy in mind?
Ensure all website contact forms ask for consent
For most businesses, a website serves as the first point of contact between the prospect and the company, because it is easier to check out the website than it is to get to the physical office.
2. Blog Comments
If you have an engaging blog like Biko Zulu‘s where the audience practically competes to post comments, then you need to be aware that you collecting visitor data. Therefore, you need to get consent to collect their data and inform them why you are collecting their data in the first place.
3. Collaborate with Partners
It’s not enough to get your website in order. you also need to check if your partners are compliant as well. Whether you are working with Facebook pixel, Google analytics, Mailchimp, salesforce or Safaricom Daraja API, it is your responsibility as website owner to check whether your partners have put measures in place to ensure data protection and privacy. Some of the questions you should think about when vetting your partners include whether they have the right tools to handle deletion requests and if they have certifications to prove compliance.
5. Get an SSL Certificate for your Website
Having a secure website (the green padlock next to your url), is crucial for SEO, building trust with visitors, and now, data protection compliance. But what does an SSL certificate have to do with data protection?
An SSL certificate has everything to do with data protection because the green padlock encrypts any information sent to you over the website like names, phone numbers and emails. With an SSL certificate, you can rest assured that even if your website gets hacked, the data is protected.
6. Update Your Website Regularly
Did you know that hackers often prey on websites with outdated software and old plugins? Therefore, it’s crucial to have a website care plan which helps you plan and follow up on your website maintenance. For a WordPress website, you only need to update your plugins, add extra layers of security and backup your pages.
In Nairobi, Kenya, it is commonplace that whenever you walk into a building , you provide your I.D details together with your contact information for security purposes. But how did you feel about it? Do you ever wonder what the management does with your information?
Similarly, your website visitors need to know why you are collecting their data and what you plan to do with it. Most importantly, they need to know that their data is protected. So let’s build websites with data protection in mind to improve trust and user experience for our website visitors.
Have you started making changes to your website to comply with data protection regulation? Are you facing any challenges? Please let us know in the comment section below, we would love to help you 🙂