Lawful Bases for Processing Personal Data
Under Section 25 of the Data Protection Act, 2019 (DPA), Elimuhub processes personal data only when we have a valid legal basis. We identify and document the specific lawful basis for each processing activity.
| Lawful Basis | Article 25 DPA | Elimuhub Examples | Requirements |
|---|---|---|---|
| Consent | 25(1)(a) | Marketing emails, newsletter subscriptions, optional analytics cookies | Freely given, specific, informed, unambiguous. Easy withdrawal [web:1] |
| Contract | 25(1)(b) | Student placement services, tutoring contracts, teacher training agreements | Necessary for contract performance or pre-contract steps [web:18] |
| Legal Obligation | 25(1)(c) | Tax records, ODPC reporting, education regulatory compliance | Required by Kenyan law (e.g., Basic Education Act) |
| Vital Interests | 25(1)(d) | Emergency contact for student safety during field trips | Life-threatening situations only [web:1] |
| Public Task | 25(1)(e) | Career guidance statistics for national education planning | Public authority functions (rare for private consultants) [web:18] |
| Legitimate Interests | 25(1)(f) | Service improvement, fraud prevention, website security | 3-part test: (1) Legitimate interest exists, (2) Necessary, (3) Balanced against rights [web:1][web:18] |
For legitimate interests processing, we conduct Legitimate Interests Assessments (LIA) documenting our necessity test and balancing exercise. You can request our LIA documentation [web:1].
Documentation
All processing activities mapped to specific lawful bases in our Data Protection Register [web:18]
Re-evaluation
Lawful bases reviewed annually or when processing purposes change [web:1]
Your Choice
Where consent applies, withdraw anytime without affecting contract services [web:18]
Special Categories (Sensitive Data): Health data for special needs students, biometric data processed only with explicit consent under Section 44 DPA or employment/contract necessity [web:2][web:18].
Comments