19/06/2026
IN THE LAST TWO DAYS WE JOINED OTHER GRASSROOT ORGANISATIONS FOR THE IJUE DATA YAKO III – SESSION 4 REPRESENTED BY Our Project Lead Allan Odeoh
DAY: 1
As CSOs we have to ask our selves:
Who owns the data we collect? And more importantly, who is responsible for the trust behind it?
How do we move from collecting data to truly protecting the people behind it?
Yesterday, our team represented by Elizabeth Khavai began a 2-day data compliance training under the Ijue Data Yako III project, facilitated by ICON Data and Learning Labs (IDL) and Amnesty International Kenya.
We are continuing a journey that is empowering 25 civil society organizations from Kakamega, Bungoma, and Busia counties to strengthen their data governance practices, build stronger systems for responsible data management, and progressively work towards becoming registered Data Controllers under Kenya’s Data Protection framework.
Day 1 challenged us to rethink data not just as a compliance requirement, but as a trust responsibility with the youth, partners, and communities we serve.
We explored the building blocks of a strong privacy program, including key internal policies such as:
* Data Protection and Information Security
* Data Retention and Disposal
* Incident Response and Data Sharing protocols
We also reflected on how we communicate transparently through Privacy Notices, Consent Statements, and Participant Information Sheets.
A key highlight was understanding Data Mapping and ROPA (Record of Processing Activities)—tools that help us clearly trace how data flows within and beyond the organization.
We also began unpacking the role of a Data Protection Officer (DPO) as a key accountability anchor in ensuring continuous compliance and trust-building.
Day 1 has already shifted how we see our responsibility not just to systems, but to people.
Grateful to Icon Data and Amnesty International Kenya for grounding this work in real practice, not just theory. And it’s been quite transformational.
DAY: 2
What happens when an organization experiences a data incident—big or small?
That was the focus of Session 4, Day 2 of the IJUE DATA YAKO III project, organized by ICON Data and Learning Labs (IDL) and Amnesty International Kenya
We unpacked incident management and breach reporting under Section 43 of the Data Protection Act, 2019—from identifying different types of data incidents and understanding reporting thresholds, to classifying breaches and estimating the number of affected data subjects.
A key highlight was the incident register: why every organization must maintain one, and how it serves as a critical accountability tool. It captures the nature of incidents, data impacted, response actions taken, notifications issued, and corrective measures implemented. Far from being just documentation, it strengthens organizational accountability and compliance.
We also explored social media strategy, focusing on purpose-driven communication and how to maximize impact through diverse formats such as posters, carousels, reels, podcasts, and infographics.
Grateful to ICON Data and Learning Labs (IDL) & Amnesty International for such a transformative and eye-opening learning experience on data protection and digital practice. The insights gained are already shaping how we think about and integrate data in our daily organizational operations.
Jenga Afrihub
ICON Data and Learning Labs
Amnesty International Kenya
Rural Women Action on Street Health
REDO KENYA
Allan Odeoh
Lightup Impact
Kenya Community Development Foundation