A data protection plan explains how a project will collect, use, store, share and retain personal information lawfully and safely. This is especially important where projects handle beneficiary, health, case-management, donor or safeguarding data.
Kenyan nonprofits now have a dedicated 2026 data-protection manual from Amnesty International Kenya translating the Data Protection Act, 2019 into practical nonprofit operations.
What should the plan include?
- Types of personal data collected.
- Purpose for collection.
- Lawful basis or consent process where applicable.
- Access permissions.
- Storage and security controls.
- Data-sharing rules.
- Retention and deletion.
- Breach-response process.
- Responsibilities and training.
Collect only what you need
More data is not automatically better. Collect information that has a defined project, legal or reporting purpose.
Separate access by role
Not every staff member needs access to beneficiary case files, health information or safeguarding records. Use role-based permissions where possible.
Plan for sharing and retention
If data will be shared with donors, partners or government agencies, define what will be shared, why, under what safeguards and for how long it will be retained.
Use the Grant Evidence Inventory to map what evidence is needed without over-collecting personal data.
Frequently Asked Questions
Is a data protection plan the same as a data management plan?
No. Data management is broader; data protection focuses specifically on personal-data rights and safeguards.
Does donor reporting justify collecting any data?
No. Collection should still be necessary, proportionate and compliant with applicable law.
Should partners follow the same controls?
Yes where they process project data.
Do we need a breach-response process?
Yes where personal data is processed.
What is the biggest mistake?
Collecting sensitive information without clear purpose, access controls or retention rules.
Conclusion
A data protection plan protects both people and the organization. Strong plans define why personal data is collected, who can access it, how it is secured and when it should be deleted.
Source
Amnesty International Kenya: Data Protection Manual for Non-Profit Organisations