Regulated SACCOs Must Navigate Data Protection Vista

SASRA-regulated SACCOs are expected to handle data with kid gloves as their digital transformation journey expands.

Regulated SACCOs have emerged as either data controllers or processors with SACCO members taking on the identity of data subjects. As SACCOs that fall under SASRA’s jurisdiction, they are required to comply with the Data Protection Act 2019 along with its slew of regulations. Compliance, reveals the SACCO Societies Regulatory Authority (SASRA)’s SACCO Supervision Annual Report 2022, is not just a legal obligation. It is a means through which SACCOs affirm the principles of data protection, pledge to commit towards nurturing their member’s trust, and a way to safeguard privacy.

The Annual Statutory Report on the Operations and Performance of Regulated SACCO Societies in Kenya also lifts the curtain on breach reporting. “Regulated SACCOs should notify the Data Commissioner of any unauthorised access of personal data that might pose a ‘real risk of harm’ to the data subject within 72 hours of becoming aware or otherwise as provided in the Act. The data controller must then communicate the occurrence of such breach to the affected data subject in writing within a reasonably practicable period.” A requirement that protects SACCO members in the event of cybercrime.

2022 dawned with a transformational shift in Kenya’s data management landscape when the implementation of the Data Protection Act 2019 came into effect in July. This landmark development was reaffirmed with the enactment of three pivotal regulations that breathed life into the Data Protection Act, 2019. The trio of regulations- the Data Protection (General) Regulations, the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, and the Data Protection (Registration of Data Controllers and Data Processors) Regulations- have all ushered in a new era of data management.

At its core, the Data Protection Act 2019 is a legislative endeavour that regulates the processing of personal data and crafts a framework to protect the rights of data subjects while outlining the obligations of data controllers and processors. Paired with the Constitution of Kenya, 2010, which enshrines the right to privacy in Article 31(c) and (d), these constitutional provisions extend safeguards against undue intrusion into “information relating to family and private affairs unnecessarily required or revealed” and “the privacy of their communications infringed.” A factor that thankfully comes into play for both Regulated and unregulated SACCOs.

Most Regulated SACCOs exist in the digital credit provision space thanks to mobile money platforms, online, and internet platforms, ATMs and SACCO agencies. However, “The formalisation of supervision and regulation of other Digital Credit Providers by the CBK presents another layer of competition for Regulated SACCOs in the already competitive digital credit provision, particularly among the tech-savvy younger generation of the population.”

Welcoming Gen Z and Millennials is a sure win for SACCOs that have lived with the perception of being outdated. The report further adds that “Although previously seen as unregulated, the formalisation of the supervision and regulation of digital credit providers is going to endear them more to the public as credible credit service providers than they were viewed before.”

SACCOs have also made it a point to digitise their financial services which is apt as Kenya has long earned the moniker “Silicon Savannah,” a testament to our tech-driven evolution. Financial transactions and inclusion lie in the embrace of fintech, fortified by the resounding success of M-Pesa. Against this backdrop, the story of Regulated SACCOs becomes a compelling tale of digital transformation.

209 Regulated SACCOs enhanced access through USSD codes, forging a user-friendly path to financial services. 109 Regulated SACCOs have also since embarked on the journey of internet-based financial services “as alternate delivery channels.”

SACCOs leveraging on technology are “reevaluating their expansion strategies through agents” according to the report. 36 innovative SACCOs that adopted said strategy transacted a staggering $179 million through agent networks. “It’s expected that this trend is likely to accelerate in the near future driven by the incentive for ease of access, efficiency and cost reduction,” aptly concludes SASRA’s report.