By the Jalika team
A welfare register holds ID numbers, phone numbers, family relationships and payment histories. That is personal data, and the Kenya Data Protection Act, 2019 sets out how it must be handled. This guide explains the main duties in plain language. It is general information, not legal advice.
The welfare is responsible for its members’ data
Under the Act, the organisation that decides why and how personal data is used is the data controller. For a welfare, that is the welfare itself, acting through its officials. Any service you use to store the data, such as a software provider, is a data processor acting on your instructions.
The principles in practice
| Principle | What it means for a welfare |
|---|---|
| Lawful and transparent | Tell members what you collect and why, for example in the membership form |
| Purpose limitation | Use the data to run the welfare, not for unrelated marketing |
| Data minimisation | Collect only what you need; do you really need every dependant’s ID number? |
| Accuracy | Let members check and correct their details |
| Storage limitation | Decide how long you keep records after a member leaves |
| Security | Protect the register from loss and from people who should not see it |
Members’ rights
Members can ask to see the data you hold about them, ask you to correct it and, in some cases, ask you to delete it or object to how it is used. Agree who handles these requests (usually the secretary) and respond promptly.
Registration with the ODPC
Some organisations must register with the Office of the Data Protection Commissioner (ODPC) as data controllers or processors, depending on factors such as their size, turnover and the kind of data they handle. Check the ODPC’s current guidance on its website to see whether your welfare must register.
A practical checklist
- Add a short privacy notice to the membership form explaining what you collect and why
- Collect only the details the constitution actually needs
- Keep the register in one secure place, not in several officials’ phones and WhatsApp chats
- Give each official access only to what their role needs
- Remove access when an official leaves office
- Keep a record of who changed what in the register
- Back up the records regularly
- Agree how long records are kept after a member leaves
- Name an official responsible for data requests
How software helps
Spreadsheets shared on WhatsApp are the biggest data protection risk most welfares have. A secure welfare management system keeps one register, gives each official a role-based login, records every change and is backed up daily, which covers most of this checklist by design.
Put these rules into practice
Jalika keeps your register, contributions, levies and claims in one place, and applies your constitution's rules automatically.