Compliance Lawyers in Muthaiga

You can reach a Gracen Law advocate within the same business day. Call +254 748 223 255, send a WhatsApp, or submit the form on this page. Urgent matters are handled same-day.

No. Gracen Law charges a consultation fee, which we confirm with you before your first meeting so there are no surprises.

We are a commercially focused firm advising entrepreneurs, corporates, investors and families across Muthaiga. Every mandate is supervised by a senior advocate, and you are told at the outset who is responsible for your file.

The Office of the Data Protection Commissioner can issue enforcement notices, compensation orders and administrative penalties, capped under section 63 at KES 5 million or 1% of annual turnover, whichever is lower. Reported penalties include KES 4.55 million against a school for processing student data without proper consent and KES 2.975 million against a digital lender for using third-party contacts in debt collection. Compensation orders to affected individuals sit on top of the penalty.

Not every organisation does. Registration as a data controller or processor turns on criteria including the nature and scale of the processing, so a small business processing limited data may fall outside it while a larger one, or one handling sensitive categories, will not. The assessment is worth doing properly and recording — guessing in either direction is costly.

Take advice before replying. The first response frames what follows: what is admitted, what is disputed, and whether the organisation appears to be engaging or resisting. Regulators respond better to a candid account with a remediation plan attached than to a defensive one. Preserve the relevant records immediately and nominate a single point of contact before any operational reply goes out.