IT Disaster Recovery Plan (Kenya)

An IT Disaster Recovery Plan in Kenya documents the it disaster recovery plan in a form the parties and authorities can rely on.

The Data Protection (General) Regulations, 2021 published under Legal Notice No. 217 of 2021 elaborate on section 41 by requiring data controllers to conduct regular testing and evaluation of the effectiveness of technical and organisational measures, including disaster recovery procedures. Regulation 26 of the Data Protection (General) Regulations requires data processors to implement technical measures including data backup, recovery systems, and documented recovery procedures as contractual obligations enforceable by the data controller.

Beyond data protection law, the Kenya Information and Communications Act (Cap. 411A) as amended, administered by the Communications Authority of Kenya (CA), requires licensed telecommunications service providers and internet service providers to maintain business continuity and disaster recovery capabilities as conditions of their operating licences under the Kenya Information and Communications (Licensing) Regulations 2010. The Central Bank of Kenya Prudential Guideline on Business Continuity Management (CBK/PG/21) requires all banks and financial institutions licensed under the Banking Act (Cap. 488) to maintain tested IT disaster recovery plans with defined Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

The ICT Authority of Kenya — established under the ICT Authority Act No. 27 of 2013 — has published the Kenya National ICT Master Plan and IT security standards that provide technical guidance on disaster recovery architecture for government agencies and public sector entities procuring ICT services under the Public Procurement and Asset Disposal Act No. 33 of 2015. The National Computer and Cybercrime Coordination Committee (NC4) established under the Computer Misuse and Cybercrimes Act No. 5 of 2018 coordinates national-level responses to cybersecurity incidents that may trigger organisational-level disaster recovery activation.

A well-structured IT Disaster Recovery Plan addresses three dimensions: prevention (hardening systems to reduce the likelihood of disasters); response (immediate actions to contain damage and preserve evidence under the Computer Misuse and Cybercrimes Act No. 5 of 2018); and recovery (systematic restoration of systems within agreed RTOs and RPOs). The plan must be tested at least annually through tabletop exercises, simulation tests, or full failover tests to remain effective and to satisfy regulatory requirements under the Central Bank of Kenya prudential guidelines and the ODPC framework.

An IT Disaster Recovery Plan is needed by every Kenyan organisation that relies on information technology systems for its operations and processes personal data subject to the Data Protection Act No. 24 of 2019.

Banks and financial institutions regulated by the Central Bank of Kenya under the Banking Act (Cap. 488) must maintain a tested IT Disaster Recovery Plan as a mandatory condition of their operating licence. The CBK Prudential Guideline CBK/PG/21 on Business Continuity Management requires banks to document RTOs and RPOs for all critical systems and to test recovery capabilities at least twice annually. Mobile money operators licensed under the National Payment System Act No. 39 of 2011 — such as those operating M-PESA infrastructure — face the same requirements.

Healthcare facilities processing patient health records — which constitute sensitive personal data under section 2 of the Data Protection Act No. 24 of 2019 — must implement disaster recovery procedures to protect medical records under both the Data Protection Act and the Health Act No. 21 of 2017 administered by the Ministry of Health.

Government agencies and county governments processing citizen data through eCitizen and Huduma Centres are required to maintain disaster recovery plans under the ICT Authority of Kenya standards and the Kenya National Cybersecurity Strategy 2022–2027 published by the Ministry of Information, Communications and Digital Economy.

E-commerce businesses and technology companies processing payment card data must comply with the PCI DSS (Payment Card Industry Data Security Standard) which requires a disaster recovery plan as part of Requirement 12.10. The Communications Authority of Kenya requires licensed ISPs and telecommunications operators to submit disaster recovery plans as part of their annual licence compliance reports.

Any organisation that has registered as a data controller or data processor with the Office of the Data Protection Commissioner under section 17 of the Data Protection Act No. 24 of 2019 should maintain a current, tested IT Disaster Recovery Plan as evidence of compliance with section 41 technical and organisational measures obligations.

Parties in Kenya should prepare a IT Disaster Recovery Plan (Kenya) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Companies Act No. 17 of 2015, the Registrar of Companies at the Office of the Attorney General maintains the register of Kenyan companies. Section 3 of the Law of Contract Act (Cap. 23) governs contractual obligations. The Competition Authority of Kenya (CAK) enforces the Competition Act No. 12 of 2010. The Kenya Revenue Authority (KRA) administers corporate tax under the Income Tax Act (Cap. 470). The High Court of Kenya has unlimited original jurisdiction under Article 165 of the Constitution of Kenya 2010. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A legally compliant and operationally effective IT Disaster Recovery Plan for Kenya must contain the following key elements aligned with the Data Protection Act No. 24 of 2019, the Data Protection (General) Regulations 2021, and the ICT Authority of Kenya technical standards.

**Plan Scope and Objectives:** A clear statement of the systems, applications, data repositories, and facilities covered by the plan; the Recovery Time Objective (RTO) — the maximum acceptable downtime for each critical system; and the Recovery Point Objective (RPO) — the maximum acceptable data loss measured in time.

**Risk Assessment and Business Impact Analysis:** An inventory of IT assets and their criticality ratings; a risk register identifying threats such as ransomware, insider threats, power failures, and natural disasters specific to the Kenyan operating environment; and a Business Impact Analysis (BIA) quantifying the financial, operational, regulatory, and reputational consequences of system unavailability.

**Disaster Declaration Criteria:** Defined thresholds and criteria for declaring a disaster and activating the DRP, including the authority responsible for disaster declaration — typically the Chief Information Officer or Chief Technology Officer — and escalation procedures to the Board Risk Committee required under the Central Bank of Kenya prudential guidelines.

**Incident Response and Notification:** Procedures for immediate response to a disaster event, including containment of damage, forensic evidence preservation under the Computer Misuse and Cybercrimes Act No. 5 of 2018, and notification to the Office of the Data Protection Commissioner within 72 hours of becoming aware of a personal data breach as required by section 43 of the Data Protection Act No. 24 of 2019.

**Recovery Procedures:** Step-by-step technical procedures for restoring each critical system, including the sequence of recovery actions, responsible personnel, fallback systems, and verification checkpoints. Cloud backup and recovery procedures referencing the organisation's cloud service agreement and the data localisation considerations under the Data Protection (General) Regulations 2021.

**Roles and Responsibilities:** A Disaster Recovery Team structure with named individuals or roles, their contact details, and specific responsibilities during recovery operations. The team must include a Data Protection Officer registered under section 24 of the Data Protection Act No. 24 of 2019.

**Testing and Review:** A schedule for annual full disaster recovery tests, quarterly tabletop exercises, and post-incident reviews. Test results, gaps identified, and remediation actions must be documented and retained for at least three years as evidence of compliance with ODPC requirements.

**Vendor and Third-Party Contacts:** Contact details for critical IT vendors, cloud service providers, internet service providers, and the Computer Emergency Response Team of Kenya (KE-CIRT/CC) operated by the Communications Authority of Kenya.

Forms Legal provides this template to assist Kenyan organisations build compliant disaster recovery documentation. Engage a certified IT professional and an advocate enrolled with the Law Society of Kenya to tailor the plan to your organisation's specific regulatory obligations. The forms-legal.com IT Disaster Recovery Plan (Kenya) template covers the mandatory elements under Data Protection Act No. 24 of 2019.

Additional compliance elements for a IT Disaster Recovery Plan (Kenya) used in Kenya include: Under the Companies Act No. 17 of 2015, the Registrar of Companies at the Office of the Attorney General maintains the register of Kenyan companies. Section 3 of the Law of Contract Act (Cap. 23) governs contractual obligations. The Competition Authority of Kenya (CAK) enforces the Competition Act No. 12 of 2010. The Kenya Revenue Authority (KRA) administers corporate tax under the Income Tax Act (Cap. 470). The High Court of Kenya has unlimited original jurisdiction under Article 165 of the Constitution of Kenya 2010. Forms-legal.com provides this template as a starting point for Kenya-compliant documentation.