Every employee generates information during their relationship with an organisation.

This can include:

• Names
• Contact details
• Identification information
• Employment contracts
• Payroll information
• Leave records
• Performance information
• Disciplinary records
• Training records
• Medical information
• Bank details
• Recruitment documents

For many businesses, these records are spread across HR files, email accounts, payroll systems, cloud storage and physical documents.

That creates an important responsibility:

How does the business ensure employee information is collected, used, stored and shared responsibly?

This is why employee data privacy in Kenya should be treated as an important part of HR management rather than simply an IT issue.

Kenya’s data-protection framework is governed by the Data Protection Act, 2019, alongside related regulations. The Office of the Data Protection Commissioner is responsible for regulating personal-data processing and protecting the rights of data subjects. Data Protection Office

What Is Employee Data?

Employee data is information relating to an identifiable employee.

Depending on the employment relationship, it can include:

Basic Information

• Name
• Phone number
• Email address
• Address
• Date of birth

Employment Information

• Job title
• Department
• Salary
• Contract
• Performance records
• Attendance
• Leave
• Training

Recruitment Information

• CV
• Qualifications
• References
• Interview notes
• Assessment results

Financial Information

• Bank details
• Payroll information
• Tax information
• Statutory deductions

Some categories of personal information require additional care because of their nature and sensitivity.

Why Employee Data Privacy Matters

1. HR Holds a Large Amount of Personal Information

Human Resources departments are often among the parts of an organisation with the greatest access to employee information.

HR may need information to:

• Process payroll
• Manage leave
• Administer benefits
• Conduct recruitment
• Manage performance
• Maintain employment records
• Meet legal obligations

Because HR handles this information for legitimate organisational purposes, it needs appropriate controls around access and use.

2. Employee Information Should Have a Clear Purpose

The ODPC states that personal data should be collected for explicit, specified and legitimate purposes and should not be processed in a manner incompatible with those purposes. Data Protection Office

In practical HR terms, this means businesses should be able to answer:

Why are we collecting this information?

For example:

If an employer needs an employee’s bank details to process salary payments, there is a clear employment-related purpose.

But collecting unnecessary information simply because:

“We might need it later”

is not a strong data-management practice.

3. Not Every Employee Should Have Access to Every HR Record

One of the most important practical controls is access management.

An employee may need access to certain information to perform their job.

That does not automatically mean they should have access to all employee records.

For example:

Payroll team: Payroll and statutory information

Line manager: Relevant performance and attendance information

HR: Appropriate employment records

IT: Technical system access without unnecessary access to HR content

Access should be based on role and legitimate business need.

Common Employee Data Privacy Risks

Risk 1: Sharing Employee Information Through Personal Messaging Apps

HR teams may sometimes use WhatsApp or other messaging platforms for convenience.

But businesses should think carefully before sending sensitive employee information through informal channels.

Examples could include:

• Salary documents
• Identification documents
• Medical information
• Disciplinary documents
• Bank information

Convenience should not replace appropriate information-security practices.

Risk 2: Leaving Physical HR Files Unsecured

Data protection isn’t only about computers.

A filing cabinet containing employee records is also a source of personal information.

Businesses should consider:

• Who has access?
• Where are the files stored?
• Can visitors access them?
• Are documents left on desks?
• How are old records disposed of?

Risk 3: Sending the Wrong Employee’s Information

Email creates another potential risk.

Before sending:

• Payroll documents
• Contracts
• Performance reports
• Certificates
• Employee letters

check the recipient carefully.

A simple email error can result in personal information being disclosed to the wrong person.

Employee Data and Recruitment

Data protection responsibilities begin before an employee is hired.

Recruitment generates information such as:

• CVs
• Phone numbers
• Email addresses
• Qualifications
• References
• Interview notes
• Assessment results

The ODPC’s published material reinforces the importance of lawful, fair and transparent processing and keeping personal data accurate and up to date. Data Protection Office

This means businesses should also consider what happens to information belonging to candidates who are not hired.

Questions to consider include:

• Why are we retaining the CV?
• How long should we keep it?
• Who can access it?
• Can it be considered for future opportunities?
• Was the candidate informed about how their information would be used?

Employee Data and HR Outsourcing

Many businesses outsource certain HR functions.

This can include:

• Payroll
• Recruitment
• HR administration
• Benefits administration
• Training
• HR systems

When personal information is shared with an external service provider, businesses should understand the roles and responsibilities of the parties involved.

The ODPC distinguishes between data controllers and data processors, with processors handling personal data on behalf of controllers. Data Protection Office

This is particularly relevant when an organisation gives an external HR provider access to employee information.

Powervision’s HR Outsourcing service supports businesses with selected HR functions. Where employee information is involved, organisations should ensure appropriate contractual and data-protection arrangements are in place.

Employee Data and Payroll

Payroll information requires particularly careful handling.

A payroll system may contain:

• Employee salaries
• Bank information
• Identification information
• Tax information
• Statutory deductions
• Benefits

Businesses should consider:

Who can access payroll?

Who can edit payroll information?

How is payroll information transferred?

How are backups protected?

What happens when an employee leaves?

These questions should be part of the organisation’s broader HR and information-security controls.

Powervision also provides Payroll Management Services for businesses seeking structured payroll support.

Employee Data and Performance Management

Performance management creates another category of employee information.

This can include:

• Performance reviews
• KPIs
• Supervisor comments
• Warnings
• Improvement plans
• Training requirements
• Promotion recommendations

Such information should be handled responsibly.

Managers should avoid discussing employee performance information with people who have no legitimate reason to access it.

Businesses can also strengthen their broader performance-management processes through Performance Management support where available.

Practical Employee Data Privacy Checklist

Businesses can start with the following checklist:

HR Records

☐ Do we know what employee information we hold?

☐ Do we know why we collect each category of information?

☐ Is the information accurate?

☐ Is unnecessary information being collected?

Access

☐ Who can access employee records?

☐ Are access rights based on job responsibilities?

☐ Are former employees’ access rights removed promptly?

Storage

☐ Are physical files securely stored?

☐ Are digital records appropriately protected?

☐ Are backups managed securely?

Sharing

☐ Do we know who employee information is shared with?

☐ Are external HR providers appropriately managed?

☐ Are sensitive records being shared through appropriate channels?

Retention

☐ Do we have appropriate retention practices?

☐ Do we know what happens to records when they are no longer required?

What Employees Should Know About Their Data

Data protection is not only an employer responsibility.

Employees also have rights as data subjects.

The ODPC explains that data subjects have rights including being informed about how their personal data is used, accessing their data, objecting to certain processing, and seeking correction or deletion of false or misleading information. Data Protection Office

Businesses should therefore ensure employees have appropriate information about how their personal data is handled.

What Should Employers Do If Something Goes Wrong?

A business should have a process for dealing with suspected data incidents.

For example:

An HR employee accidentally sends a salary file to the wrong email address.

The business should not simply ignore the incident.

It should have a process to:

1. Identify what happened.
2. Establish what information was involved.
3. Determine who received it.
4. Contain the incident where possible.
5. Assess the potential impact.
6. Take appropriate corrective action.
7. Follow applicable reporting and notification requirements.

The ODPC provides mechanisms for reporting data breaches and complaints and has an established compliance function for data-protection oversight. Data Protection Office

Employee Data Privacy Is an HR Responsibility

Data protection is sometimes treated purely as an IT issue.

But HR plays a major role because it manages information throughout the employee lifecycle:

Recruitment

↓

Onboarding

↓

Employment

↓

Performance Management

↓

Payroll

↓

Training

↓

Exit

Every stage can involve personal information.

This means HR professionals, managers and business leaders all have a role to play.

How Powervision Consultancy Can Help

Good HR management involves more than hiring employees.

It also involves establishing appropriate systems and processes for managing people throughout their employment.

Powervision Consultancy provides HR Consultancy and HR support covering areas such as HR compliance, employee records, policies and workplace processes.

Businesses can also use HR Outsourcing where selected HR functions need specialist support.

For recruitment, Powervision’s Recruitment and Selection service supports candidate sourcing, screening, shortlisting and assessment.

Frequently Asked Questions

What is employee data privacy?

Employee data privacy concerns how an organisation collects, uses, stores, shares and protects personal information relating to employees.

Does data protection apply to recruitment?

Yes. Candidate information such as CVs, contact details, qualifications and assessment information is personal data and should be handled appropriately.

Who should have access to employee records?

Access should generally be limited according to legitimate business need and job responsibilities.

Can HR share employee information with external providers?

It may be necessary in some circumstances, but businesses should understand the applicable data-protection requirements and establish appropriate arrangements with service providers.

Is employee data privacy only an IT responsibility?

No. HR, management, IT and other employees who handle personal information all have responsibilities in maintaining appropriate data-protection practices.

Conclusion

Employee data privacy in Kenya should be part of every organisation’s HR strategy.

Employee information is collected from the moment a person applies for a position and can continue to be processed throughout recruitment, employment, payroll, performance management and exit.

Businesses therefore need to think beyond simply storing documents.

They need to consider:

What information do we collect?

Why do we collect it?

Who can access it?

How do we protect it?

How long should we retain it?

What happens when something goes wrong?

The ODPC’s regulatory framework makes clear that organisations handling personal data have responsibilities around lawful, fair, transparent and purpose-specific processing. Data Protection Office

Protecting employee information is not just a compliance exercise. It is part of responsible HR management and building trust in the workplace.