Data Protection & Privacy Charter

St. Anne Catholic Parish Kibiko and the Catholic Diocese of Ngong are strictly committed to safeguarding the personal, sacramental, and financial data of all parishioners in accordance with the Kenya Data Protection Act, 2019 (DPA), the General Data Protection Regulation (GDPR), and international information security standards (ISO/IEC 27001 & 27701).

Effective Date: October 16, 2026 • Statutory Registration with ODPC (Kenya) • Code of Canon Law (CIC Can. 535)

Kenya DPA 2019

Enforced by the Office of the Data Protection Commissioner (ODPC). We operate as a registered Data Controller & Processor, adhering to the 8 statutory data protection principles under Section 25.

GDPR Special Category

Article 9(2)(d) GDPR compliance for diaspora donors and international benefactors. Religious beliefs are treated as Special Category Data, processed solely within legitimate ecclesiastical activities.

ISO/IEC 27001 & 27701

Global information security & privacy information management standards. Enforcing AES-256 encryption at rest, TLS 1.3 in transit, automated audit trails, and strict multi-tier role-based access.

1. Categories of Personal & Sensitive Data Processed

Under Section 44 of the Kenya DPA, religious affiliation constitutes Sensitive Personal Data requiring heightened safeguards.

A. Civil & Contact Data

Full legal names, national ID/passport numbers, telephone numbers, physical estate/village coordinates, and email addresses.

B. Canonical & Sacramental Data

Baptismal registers, Holy Communion, Confirmation, Canonical Marriage details, godparents, canonical standing, and presbyteral notes.

C. Household & Jumuiya Affiliation

Head of household structure, family members, Small Christian Community (Jumuiya ya Mtaa) membership, and pastoral assistance logs.

D. Stewardship & Utility Data

Tithes, Sunday Mass offertories, Matega pledges, M-Pesa transaction reference codes, water meter readings, and token vending logs.

2. Lawful Basis for Processing

We process personal data under the following legal bases stipulated in Section 30 & Section 47 of the Kenya Data Protection Act 2019 and Article 6 & Article 9 of the GDPR:

Legitimate Non-Profit / Religious Entity Activities (Section 47 DPA / GDPR Art. 9(2)(d)): Processing carried out in the course of legitimate pastoral and ecclesiastical care by the Catholic Church for its baptized faithful and regular participants. Data is strictly confined within church governance and never disclosed externally without explicit consent.
Canonical Legal Obligation (CIC Can. 535): Under Catholic Canon Law, the parish is canonically obligated to maintain permanent baptismal, confirmation, and marriage registers.
Explicit Consent (Section 32 DPA / GDPR Art. 6(1)(a)): For optional communications (SMS parish broadcasts, digital newsletters, and non-mandatory activities).
Contractual Necessity & Public Interest: For utility provision (community water meters and revenue billing).

3. Data Subject Rights (Section 26 Kenya DPA)

Every registered parishioner and donor possesses enforceable legal rights over their personal data:

1. Right of Access: You can view your full pastoral, family, and giving ledger directly in your member portal.

2. Right to Rectification: Request correction of inaccurate names, phone numbers, or sacramental record dates.

3. Right to Data Portability: Download a machine-readable archive (JSON/CSV) of your personal profile and stewardship records.

4. Right to Object & Restrict: Opt out of SMS broadcasts, fundraising alerts, or public acknowledgement of donations.

*Note: Sacramental registers (Baptism, Confirmation, Holy Matrimony) constitute permanent canonical records under Canon Law (Can. 535) and cannot be deleted, but may be noted or updated in accordance with canonical norms.

4. Technical Security & ISO 27001 Safeguards

Multi-Tier RBAC

Granular 5-tier role-based access control ensuring leaders only see their canonical jurisdiction.

Encryption in Transit & Rest

Enforced TLS 1.3 HTTPS with HSTS preload and AES-256 database storage encryption.

Immutable Audit Logs

Cryptographically timestamped action logging for every mutation, view, and deletion.

72-Hour Breach Notification Protocol

In compliance with Section 43 of the Kenya Data Protection Act 2019, MzabibuDigital enforces an automated breach response protocol: in the unlikely event of a security incident affecting personal data, the Parish Data Protection Officer will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of awareness, and communicate protective guidance to all affected parishioners immediately.

Parish Data Protection Officer (DPO): dpo@stannekibiko.org

ODPC Kenya: info@odpc.go.ke • Tel: +254 703 039 000