Compliance & Certifications
Demonstrating our commitment to data protection, regulatory compliance, and industry best practices across East Africa
Our Commitment to Compliance
At Virtual Support Services, we recognize that trust is the foundation of every client relationship. We are committed to maintaining the highest standards of data protection, regulatory compliance, and information security. Our compliance programme is built on the Kenya Data Protection Act, 2019 and aligned with international best practices.
As a registered Data Controller and Data Processor with the Office of the Data Protection Commissioner (ODPC), and as an ICTA-accredited Government ICT supplier, we demonstrate our ongoing commitment to protecting personal data and upholding the rights of data subjects.
Government Accreditations
ICTA Accredited: Cloud Computing
Virtual Support Services Limited has demonstrated compliance with the Government IT Governance Standard, Criteria for accreditation of Government ICT Suppliers/Contractors and has been accredited under Category ICTA 4: CLOUD COMPUTING for the provision of ICT services.
ICTA Accredited: Systems & Applications
Virtual Support Services Limited has demonstrated compliance with the Government IT Governance Standard, Criteria for accreditation of Government ICT Suppliers/Contractors and has been accredited under Category ICTA 4: SYSTEMS AND APPLICATIONS for the provision of ICT services.
Kenya Data Protection Act, 2019
The Data Protection Act, No. 24 of 2019, gives effect to Article 31(c) and (d) of the Constitution of Kenya. It establishes the Office of the Data Protection Commissioner and provides for the regulation of the processing of personal data, the rights of data subjects, and obligations of data controllers and processors. VSS is fully compliant with this Act.
Our Registration Status
The 7 Principles of Data Protection We Follow
Lawfulness, Fairness & Transparency
Personal data is processed lawfully, fairly and in a transparent manner in relation to the data subject.
Purpose Limitation
Personal data is collected and processed for specified, explicit and legitimate purposes only.
Data Minimization
Personal data collected is limited to what is necessary for the specified, explicit and legitimate purposes.
Accuracy
Personal data is accurate and, where necessary, kept up to date with every reasonable step taken to ensure accuracy.
Storage Limitation
Personal data is stored for no longer than is necessary for the specified, explicit and legitimate purposes.
Accountability & Transparency
VSS takes responsibility for personal data and ensures individuals can exercise their rights while providing clear information on data processing.
Integrity & Confidentiality
Personal data is secured and protected against unauthorized or unlawful processing and against accidental loss, destruction or damage.
Data Subject Rights
Under the Kenya Data Protection Act, 2019 (Section 26), data subjects have the following rights which VSS fully upholds and facilitates:
Right of Access
Data subjects have the right to access their personal data held by VSS and obtain information about how it is processed.
Right to Rectification
Data subjects can request correction of inaccurate or incomplete personal data.
Right to Erasure
Data subjects can request deletion of their personal data where there is no compelling reason for continued processing.
Right to Data Portability
Data subjects can request a copy of their personal data in a structured, commonly used format.
Right to Object
Data subjects can object to the processing of their personal data in certain circumstances.
Right to Restrict Processing
Data subjects can request limitation on the processing of their personal data.
Right Not to be Subject to Automated Decisions
Data subjects have the right not to be subject to decisions based solely on automated processing, including profiling.
Compliance Frameworks
Kenya Data Protection Act, 2019
Full compliance with Kenya's data protection legislation giving effect to Article 31(c) and (d) of the Constitution of Kenya.
ODPC Registration
Registered with the Office of the Data Protection Commissioner as both a Data Controller and Data Processor.
Government IT Governance Standard
Accredited by ICTA for Cloud Computing and Systems & Applications under the Government ICT Suppliers/Contractors criteria.
Microsoft Partner Compliance
Adherence to Microsoft's data protection standards and partner compliance requirements.
ISO 27001 Aligned Practices
Information security management practices aligned with international standards.
GDPR Awareness
For applicable international clients, we maintain awareness of and alignment with GDPR requirements.
Data Controller & Data Processor Obligations
As a Data Controller, VSS:
- Determines the purposes and means of processing personal data
- Obtains consent before collecting personal information
- Ensures data is collected for specified and legitimate purposes
- Implements appropriate technical and organizational security measures
- Notifies data subjects and the ODPC of personal data breaches
- Conducts Data Protection Impact Assessments where required
- Maintains records of all processing activities
As a Data Processor, VSS:
- Processes personal data only on instructions from the Data Controller
- Ensures confidentiality of personal data during processing
- Implements appropriate security measures to protect data
- Does not engage sub-processors without prior authorization
- Assists the Data Controller in responding to data subject requests
- Returns or deletes personal data after processing is complete
- Maintains records of processing carried out on behalf of controllers
Data Breach Notification
In accordance with Section 43 of the Data Protection Act, 2019, VSS has established comprehensive data breach notification procedures:
Detect & Assess
Immediate assessment of any breach or suspected breach to determine scope, severity, and impact on data subjects.
Notify ODPC
Notification to the Data Commissioner within 72 hours of becoming aware of a personal data breach, as required by law.
Inform Data Subjects
Communication to affected data subjects without unreasonable delay, including the nature of the breach and recommended protective measures.
Office of the Data Protection Commissioner (ODPC)
The ODPC is an Independent State Office under the Ministry of Information, Communications and the Digital Economy. It is responsible for ensuring compliance with data protection laws in Kenya.
Your Rights as a Data Subject
If you believe your personal data has been mishandled or your data protection rights have been violated, you have the right to lodge a complaint with the ODPC:
Visit the ODPC websiteQuestions About Our Compliance?
Our Data Protection Officer is available to address any questions about our compliance practices, data protection measures, or to help you exercise your data subject rights.