Privacy Policy

The Open University of Kenya (OUK) is a specialised public university chartered in August 2023. OUK is the data controller for the personal data described in this policy.

This policy explains how we collect, use, share and protect personal data on our website, admissions and student portals, learning management system (LMS), email and other digital services, and the rights you have under the Data Protection Act, 2019.

This policy applies to everyone whose personal data we process, including:

• prospective students, current students and alumni;
• academic, administrative and support staff, whether permanent, temporary or on contract;
• contractors, consultants and third-party service providers;
• researchers and collaborators working with the University;
• visitors to our website and anyone else who uses our digital services.

Depending on how you deal with us, we may collect:

• Identity and contact details, such as your name, date of birth, identification number, email address, phone number and postal address.
• Application and academic records, such as qualifications, admission files, course registration, assessment results, transcripts and graduation records.
• Financial data, such as fees, payments, sponsorship and refunds.
• Learning and portal activity, such as sign-ins, course participation, submissions and messages sent through University systems.
• Technical data, such as your IP address, browser and device type, pages visited and cookies.
• Communications, such as enquiries, complaints, feedback and support requests.

We collect personal data directly from you wherever possible, and only what we need for a stated purpose.

Sensitive personal data, such as health status, disability, biometric data, ethnic or social origin, or family details, is collected only where it is needed, for example to provide disability support, and with your explicit consent where the law requires it. Access to it is restricted and protected by stronger security controls.

We use personal data to:

• process applications, admit and register students;
• deliver teaching, learning and assessment, and manage examinations and graduation;
• keep student and staff records;
• process fees, payments and sponsorships;
• provide student support, the service desk and complaints handling;
• send news, events and service updates, which you can unsubscribe from at any time;
• carry out approved research;
• keep our systems secure and detect, investigate and prevent misuse or fraud;
• meet our legal and regulatory reporting obligations;
• improve our services, using statistics that do not identify you wherever possible.

We process personal data only where the Data Protection Act, 2019 gives us a lawful basis:

• Consent that you have given;
• Contract, such as your student registration or employment;
• Legal obligation that applies to the University;
• Vital interests, to protect someone's life or health;
• Public task, carried out by the University as a public institution;
• Legitimate interests of the University, where these are not overridden by your rights.

Where we rely on consent, it must be freely given, specific, informed and unambiguous. We record the lawful basis for each processing activity and review it when the activity changes.

• Lawfulness, fairness and transparency: we process data lawfully and tell you clearly what we do with it.
• Purpose limitation: we collect data for specific, legitimate purposes and do not use it in ways that do not fit those purposes.
• Data minimisation: we collect only what is necessary.
• Accuracy: we keep data accurate and up to date, and correct it when needed.
• Storage limitation: we keep data only as long as necessary, then dispose of it securely.
• Integrity and confidentiality: we protect data against unauthorised access, loss or damage.
• Accountability: we can show that we follow these principles.

We share personal data only when it is necessary, lawful and consistent with the purpose for which it was collected. Recipients may include:

• service providers that host or run systems for us, such as cloud hosting, email, payment processing and technical support, under written data processing agreements;
• government agencies and regulators, where the law requires it;
• partner institutions and sponsors, where this is part of your programme or you have agreed;
• courts and law enforcement bodies acting under a court order, warrant or other lawful directive.

Vendors who handle University data must meet our security and data protection requirements, report any incident affecting our data promptly, and return or destroy the data when their contract ends.

Some services we use, such as cloud services, may store or process data outside Kenya. Such transfers follow the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021 and directives of the Office of the Data Protection Commissioner (ODPC). We transfer personal data outside Kenya only:

• where there is a lawful basis and a legitimate academic, administrative, research or operational need;
• where the recipient provides adequate protection, or appropriate safeguards are in place;
• with contractual, technical and organisational safeguards for the data in transit, in storage and in use;
• after a risk assessment or data protection impact assessment for high-risk transfers.

We keep a record of each transfer, including its purpose, recipient, destination, legal basis and safeguards.

We run an information security management system aligned with ISO/IEC 27001. Our safeguards include:

• role-based access, so people see only the data their work requires;
• multi-factor authentication for critical systems and sensitive data;
• encryption of sensitive data in storage and in transit;
• network and device protection, continuous monitoring and audit logs;
• regular vulnerability assessments and penetration testing;
• backups and tested recovery plans;
• privacy by design and by default when we build or buy systems;
• regular data protection and security training for staff.

We keep personal data only as long as needed for its purpose or as the law requires, following the University's Data Retention and Disposal Schedule:

• Student admission and academic records (admission files, transcripts, graduation records): in line with the University's Records Management Policy and the law, then securely archived or destroyed.
• Examination records (scripts, assessment records, results): in line with University examination regulations, then securely destroyed.
• Human resource records (personnel files, leave and payroll records): in line with labour laws and HR policies, then securely destroyed.
• Financial and procurement records: in line with the Public Finance Management Act, tax and procurement laws and audit requirements, then securely destroyed.
• Research records (participant data, ethics documents): in line with research ethics requirements and funding agreements, then securely archived or destroyed.
• System logs and CCTV recordings: in line with security and audit requirements and the law, then securely deleted.
• Data collected through our digital platforms (portal information, online applications): as long as needed for the stated purpose or required by law, then securely deleted or anonymised.

Where a law sets a specific retention period, that period applies.

Under the Data Protection Act, 2019 you have the right to:

• be informed about how your personal data is collected, used, stored and shared;
• access your personal data;
• have inaccurate or incomplete data corrected;
• have your data erased, where the law allows;
• restrict or object to processing, in particular processing based on legitimate interests;
• receive your data in a structured, commonly used format (data portability);
• withdraw your consent at any time, without affecting processing that took place before.

To use any of these rights, contact the Data Protection Officer. We acknowledge a request to withdraw consent within 5 working days and act on it within 30 calendar days. If we must keep processing because the law or another lawful basis requires it, we will tell you why. Withdrawing consent will not lead to any penalty or disadvantage, except where the processing is needed to provide a service or meet a legal obligation.

We use cookies to keep you signed in, remember your preferences and understand how our website is used. Read our Cookie Policy or change your choices in the Privacy Centre.

We have procedures to detect, report, contain and investigate personal data breaches. Where a breach is likely to put your rights and freedoms at risk, we notify the Office of the Data Protection Commissioner within the timelines set by the Data Protection Act, 2019, and tell the people affected where the law requires.

If you suspect a breach, a phishing attempt or another security incident involving University systems, report it to ict@ouk.ac.ke.

Personal data used in research is handled under approved research ethics frameworks, with ethics review, anonymisation or pseudonymisation wherever possible, and no publication of identifiable data unless it is justified, lawful and ethically approved.

The law allows limited exemptions from some data protection requirements, for example for public health and safety, crime prevention, court orders or research. We apply them only when they are lawful, necessary and proportionate, with documented reasons and oversight by the Data Protection Officer.

For questions about this policy or your personal data, contact the Data Protection Officer:

• Email: dpo@ouk.ac.ke
• Post: Open University of Kenya, P.O. Box 2440-00606, Nairobi
• Phone: +254 20 200 0211

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner.

We review this policy when the law, our services or the University's data protection policy change, and at least every three years. The dates and revision history on this page show when it last changed.