Data Lifecycle Management

Collection

• Obtain explicit consent where possible; use vital interests/public interest in emergencies.
• Provide privacy notices at collection (e.g., via intake forms).
• Minimize: Collect only essentials (e.g., name, emergency context for enrollment).

Processing and Use

• Process in Kenya; cross-border transfers require ODPC approval or safeguards (DPA Section 25).
• Use for education delivery only; log all access.

Sharing

See Risk Assessments for details. Disclose only with consent or legal basis; anonymize where possible.

Disposal

• Securely delete (e.g., overwriting digital files, shredding paper) when retention ends.
• Maintain disposal logs.