Data Protection & Compliance
Last Updated: January 2025
Version: 2.0
Executive Summary
OpenCHS demonstrates unwavering commitment to data protection through compliance with international and regional legal frameworks. This document provides assurance to donors, government partners, and implementing organizations.
Quick Reference
| Framework | Status | Documentation |
|---|---|---|
| 🇰🇪 Kenya DPA 2019 | ✅ Compliant | Details |
| 🇺🇬 Uganda DPPA 2019 | ✅ Compliant | Details |
| 🇹🇿 Tanzania PDPA 2022 | ✅ Compliant | Details |
| 🇱🇸 Lesotho DPA 2011 | ✅ Compliant | Details |
| 🇪🇺 GDPR | ✅ Compliant | Details |
| 🇺🇳 UNCRC | ✅ Aligned | Details |
| 🇺🇳 CRPD | ✅ Aligned | Details |
1. Core Commitment
BITZ IT Consulting Ltd. affirms that OpenCHS:
✅ Protects Personal Data by design and by default
✅ Safeguards Children with enhanced protections
✅ Ensures Compliance across all deployment jurisdictions
✅ Maintains Transparency in data handling practices
✅ Upholds Accountability through regular audits
2. Adherence to Legal Frameworks
Regional Compliance
🇰🇪 Kenya - Data Protection Act (2019)
Status: Fully Compliant
- Data Controller registration with ODPC
- Privacy notices in Swahili and English
- Data Protection Impact Assessments (DPIAs)
- Data breach notification procedures (72 hours)
- Data subject rights implementation
Contact: Office of the Data Protection Commissioner
Email: info@odpc.go.ke
Website: odpc.go.ke
🇺🇬 Uganda - Data Protection and Privacy Act (2019)
Status: Fully Compliant
- Registration with Personal Data Protection Office
- Consent mechanisms for data processing
- Cross-border data transfer safeguards
- Privacy by design implementation
- Regular compliance audits
Contact: Personal Data Protection Office
Email: info@pdpo.go.ug
Website: pdpo.go.ug
🇹🇿 Tanzania - Personal Data Protection Act (2022)
Status: Fully Compliant
- Data processing registration
- Data protection officer appointment
- Privacy policy publication
- Data security measures
- Compliance monitoring
🇱🇸 Lesotho - Data Protection Act (2011)
Status: Fully Compliant
- Registration requirements met
- Privacy safeguards implemented
- Data security standards maintained
International Benchmark
🇪🇺 GDPR (2016/679)
Status: Benchmark Standard
OpenCHS uses GDPR as the gold standard, ensuring:
- Lawfulness, fairness, and transparency
- Purpose limitation
- Data minimization
- Accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
3. International Standards
🇺🇳 UN Convention on the Rights of the Child (UNCRC)
Alignment Areas:
- Article 3: Best interests of the child as primary consideration
- Article 16: Protection from interference with privacy
- Article 19: Protection from all forms of violence
Implementation:
- Enhanced data protection for child information
- Age-appropriate consent mechanisms
- Privacy-preserving case management
- Secure data handling protocols
🇺🇳 UN Convention on the Rights of Persons with Disabilities (CRPD)
Alignment Areas:
- Article 9: Accessibility of information and communications
- Article 22: Respect for privacy
Implementation:
- Accessible interface design (WCAG 2.1 AA)
- Screen reader compatibility
- Alternative input methods
- Dignity-preserving data practices
4. Operational Implementation
Compliance is embedded in every layer of OpenCHS:
Privacy by Design
┌─────────────────────────────────────────┐
│ Privacy by Design Principles │
├─────────────────────────────────────────┤
│ 1. Proactive not Reactive │
│ 2. Privacy as Default Setting │
│ 3. Privacy Embedded in Design │
│ 4. Full Functionality │
│ 5. End-to-End Security │
│ 6. Visibility and Transparency │
│ 7. Respect for User Privacy │
└─────────────────────────────────────────┘Implementation:
✅ Data Minimization
- Collect only necessary data
- Regular data necessity reviews
- Automatic field validation
✅ Anonymization & Pseudonymization
- PII masked in analytics
- Pseudonyms for reporting
- De-identification tools
✅ Purpose Limitation
- Documented processing purposes
- Consent for secondary use
- Purpose-specific access controls
Security Architecture
Multi-Layer Protection:
🔐 Layer 1: Application Security
- Input validation
- XSS protection
- CSRF tokens
- Secure session management
🔐 Layer 2: Data Security
- TLS 1.3 encryption (transit)
- AES-256 encryption (rest)
- Encrypted backups
- Secure key management
🔐 Layer 3: Access Security
- Role-Based Access Control (RBAC)
- Multi-Factor Authentication (MFA)
- Principle of least privilege
- Regular access reviews
🔐 Layer 4: Infrastructure Security
- ISO 27001 certified hosting
- SOC 2 Type II compliance
- Firewall protection
- Intrusion detection
🔐 Layer 5: Monitoring
- 24/7 security monitoring
- Audit trail logging
- Anomaly detection
- Incident response
Data Protection Impact Assessments (DPIAs)
When Conducted:
- New deployment in jurisdiction
- New feature involving PII
- Significant system changes
- Annual compliance review
DPIA Process:
Risk Identification
- Data flow mapping
- Threat assessment
- Vulnerability analysis
Impact Analysis
- Likelihood evaluation
- Severity assessment
- Mitigation planning
Consultation
- Stakeholder input
- DPO review
- Legal counsel
Documentation
- Risk register
- Mitigation measures
- Approval sign-off
Training & Awareness
Mandatory Training Programs:
| Role | Training Type | Frequency |
|---|---|---|
| All Users | Data Protection Basics | Annual |
| Operators | Secure Data Handling | Annual |
| Supervisors | Privacy Management | Annual |
| Administrators | Technical Security | Quarterly |
| DPO | Advanced Compliance | Ongoing |
Training Content:
- Legal framework overview
- Data subject rights
- Secure data practices
- Incident response
- Case studies
Verification:
- Completion certificates
- Assessment tests
- Training records
- Audit trails
5. Data Sovereignty
In-Country Data Residency
Default Configuration:
- Data stored within country of operation
- Local server deployment options
- Regional cloud availability
- Data sovereignty compliance
Supported Configurations:
| Country | Storage Location | Backup Location | Compliance |
|---|---|---|---|
| 🇰🇪 Kenya | Nairobi DC | Regional | ✅ ODPC Approved |
| 🇺🇬 Uganda | Kampala DC | Regional | ✅ PDPO Approved |
| 🇹🇿 Tanzania | Dar es Salaam DC | Regional | ✅ Compliant |
| 🇱🇸 Lesotho | Local/Regional | Regional | ✅ Compliant |
Cross-Border Transfers
Safeguards Required:
- ✅ Standard Contractual Clauses (SCCs)
- ✅ Data Processing Agreements (DPAs)
- ✅ Adequacy decisions
- ✅ Explicit consent
- ✅ Legal framework compliance
Transfer Principles:
- Minimal data transfer
- Purpose-specific transfers
- Documented justification
- Regular compliance reviews
6. Continuous Improvement
Monitoring & Review
Regular Activities:
📅 Monthly
- Security log reviews
- Access audits
- Incident reviews
📅 Quarterly
- Compliance assessments
- Policy updates
- Training delivery
📅 Annually
- Full compliance audit
- DPIA reviews
- Legal framework updates
- Certification renewals
Audit Program
Internal Audits:
- Monthly security reviews
- Quarterly compliance checks
- Annual comprehensive audit
External Audits:
- Independent security assessments
- Regulatory inspections
- Third-party certifications
7. Certification & Standards
Target Certifications
| Certification | Status | Target Date |
|---|---|---|
| ISO 27001 | 🔄 In Progress | Q2 2025 |
| SOC 2 Type II | 🔄 In Progress | Q3 2025 |
| CSA STAR | 📋 Planned | Q4 2025 |
8. Contact Information
Compliance Inquiries
📧 Data Protection Officer: dpo@openchs.com
🌐 Website: https://openchs.com/compliance
📞 Phone: [Contact implementing organization]
Regulatory Contacts
Kenya: Office of the Data Protection Commissioner
- Email: info@odpc.go.ke
- Website: odpc.go.ke
Uganda: Personal Data Protection Office
- Email: info@pdpo.go.ug
- Website: pdpo.go.ug
9. Related Documentation
- Privacy Policy - User-facing privacy information
- Data Privacy & Security - Technical implementation
- Terms of Service - Legal agreements
- Open Source License - Software licensing
Last Updated: January 2025
Next Review: July 2025
Version: 2.0