Lawful and fair processing
Personal data should be handled for legitimate purposes, transparently and in accordance with applicable Kenyan data-protection requirements.
Privacy and data protection
Protecting personal information with dignity and accountability
Norisha Foundation recognises that responsible use of personal information is essential to protecting beneficiaries, families, supporters, staff, volunteers and partners. Privacy must be built into our programmes, systems and operational decisions.
Our approach
Privacy by design
Norisha aims to integrate privacy and data protection into the design of programmes, beneficiary services, digital platforms, communications and institutional processes.
Our approach is guided by applicable Kenyan law, including the Data Protection Act, 2019, its implementing regulations and other legal or safeguarding obligations relevant to particular activities.
This page is a public statement of direction. Detailed internal policies, retention schedules, processing records, security controls and programme-specific notices are maintained and developed according to operational and legal requirements.
Core principles
Responsible data handling
Purpose limitation
Information should be collected for defined programme, safeguarding, operational, accountability or legal purposes and not reused incompatibly.
Data minimisation
Norisha should collect only the information reasonably necessary for the purpose being served.
Accuracy
Reasonable measures should be used to keep personal information accurate, relevant and appropriately updated.
Storage limitation
Personal information should not be retained longer than required by its purpose, applicable law, safeguarding duties or legitimate institutional needs.
Security and confidentiality
Access should be restricted according to responsibility and protected through appropriate organisational and technical safeguards.
Sensitive information
Higher protection where the risk is higher
Information relating to children, vulnerable persons, health, disability, identity, safeguarding cases, financial matters and other sensitive circumstances requires heightened care.
- Role-based access to beneficiary, donor, staff and case information
- Additional controls for children and other vulnerable persons
- Consent and lawful-authority checks where applicable
- Controlled handling of photographs, video, voice and location information
- Secure management of identity and supporting documents
- Risk assessment for sensitive processing and digital services
- Documented handling of suspected privacy or security incidents
Individual rights
Respect for the person behind the data
Subject to applicable law and legitimate exemptions, people whose personal information is processed by Norisha may have rights relating to that information.
- Be informed about relevant processing of personal information
- Request access to personal data where legally applicable
- Request correction of inaccurate or misleading information
- Object to or seek restriction of certain processing where applicable
- Request deletion where the law permits and retention is no longer justified
- Raise a privacy concern through Norisha's official channels
Sharing and transfers
Controlled disclosure
Personal information should only be shared where there is a legitimate and lawful basis, appropriate safeguards and a clear operational, safeguarding, contractual or legal purpose.
Where information is processed by service providers, partners or across borders, Norisha should apply proportionate contractual, security and data-protection controls appropriate to the nature and sensitivity of the information involved.
Privacy concerns
Questions, corrections or concerns
Anyone with a question about Norisha's handling of personal information, or who wishes to raise a privacy concern, should contact the Foundation through its official communication channels. Requests will be assessed according to applicable law, safeguarding requirements and verified identity where necessary.
Contact Norisha