Privacy Notice | Data Privacy Management System

Privacy Notice — DSR Portal

Last updated: 16 July 2026 | Your Organisation Name — Data Protection Office

This Privacy Notice explains how Murang'a University of Technology (MUT) collects, uses, and protects your personal data when you submit a Data Subject Request through this portal, in accordance with the Kenya Data Protection Act, 2019.

1. Who We Are (Data Controller)

Organisation	Your Organisation Name
Data Protection Officer	dpo@yourorganisation.ke
Applicable Law	Kenya Data Protection Act, 2019
ODPC Registration	Registered / Pending Registration

2. What Personal Data We Collect and Why

Field	Why We Collect It	Legal Basis
Full Name	To verify you are the data subject or authorised representative	Legal Obligation — s.30(1) KDPA
Email Address	To send acknowledgement, verification code, and final response	Legal Obligation — s.30(2) KDPA
Phone Number (optional)	Alternative contact channel if email delivery fails	Legitimate Interest
ID Type	To categorise your identity document for verification	Legal Obligation — s.30(1) KDPA
ID Number	To verify your identity against MUT records. Masked in our systems.	Legal Obligation — s.30(1) KDPA
Request Type	To determine which legal right you are exercising and route accordingly	Legal Obligation — ss.26-31 KDPA
Description	To understand the scope of your request and respond accurately	Legal Obligation — s.30 KDPA
Supporting Document (optional)	To assist identity verification or substantiate your request	Legitimate Interest
Declaration	To record your confirmation of accuracy — creates accountability record	Accountability — s.25(g) KDPA
Submission Timestamp	To calculate the 30-day statutory response deadline	Legal Obligation — s.30(2) KDPA
IP Address	To record evidence of submission for the audit trail	Accountability — s.25(g) KDPA
Reference Number	To enable tracking and maintain the statutory DSR register	Legal Obligation — ODPC requirements

3. How We Use Your Data

Your personal data is used exclusively for the following purposes:

Verifying your identity as the data subject or authorised representative
Processing and responding to your Data Subject Request
Communicating with you about the progress of your request
Maintaining a statutory DSR register for ODPC compliance
Maintaining an immutable audit trail as required by the KDPA

⚠ Your data will NOT be used for marketing, profiling, or shared with any third party except where required by law or court order.

4. How Long We Keep Your Data

Request Outcome	Retention Period	Action After Period
Completed request	3 years after completion	Personal data anonymised
Rejected request	1 year after rejection	Personal data anonymised
Audit log entries	Minimum 3 years	Retained for ODPC compliance

5. How We Protect Your Data

All data is transmitted over HTTPS/TLS encrypted connections
ID numbers are masked in our systems — only the last 4 digits are visible to staff
Uploaded documents are stored in a secured, access-controlled location accessible only by the DPO
Access to DSR records is role-based — only authorised officers can view requests
All actions are recorded in an immutable audit log that cannot be altered or deleted
The database is not accessible from outside our network

6. Your Data Protection Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

Access — request a copy of the data we hold about your DSR submission
Rectification — correct any inaccurate information in your submission
Erasure — request deletion of your DSR data after the retention period
Objection — object to any processing beyond what is strictly necessary
Complaint — lodge a complaint with the ODPC at www.odpc.go.ke

To exercise any of these rights regarding your DSR submission data, contact: dpo@yourorganisation.ke

Contact the Data Protection Officer
For any data protection queries, complaints, or to exercise your rights:
dpo@yourorganisation.ke | Your Organisation Name, Data Protection Office