Data Protection Compliance for Kenyan SACCOs: Securing Member Data on a Cloud ERP

الإجابة المختصرة

A SACCO is a data controller under the Kenya Data Protection Act, 2019, and holds financial and personal data on every member. Moving to a cloud ERP does not remove those duties. It changes where the data sits and who else touches it, so the controls and the contracts need to be right. This article is a practical guide and is not legal advice.

What a SACCO has to think about

• Registration with the Office of the Data Protection Commissioner (ODPC) as a data controller or processor, as the rules require.
• A lawful basis for collecting and using member data, and clear privacy notices.
• Member rights: access, correction and deletion where the law allows.
• Security safeguards that fit the risk.
• Notification of a breach to the Commissioner and to those affected, within the time the law sets.
• Rules for sending personal data outside Kenya, which matter for any cloud service.
• Contracts with processors, including your ERP partner and your cloud provider.

Technical controls to look for in a SACCO system

• Role-based access, so staff see only what their job needs.
• A log of who viewed or changed member data.
• Approval of changes to sensitive data such as bio-data and signatories.
• Encryption in transit and at rest, and careful handling of PINs and one-time codes in any mobile channel.
• Separate permissions for the people who run the system and those who use it.
• Retention and exit rules for members who leave.

What SaccoFlow 365 provides

SaccoFlow 365 keeps member data inside Business Central, with eleven permission sets, role centers by job, change logging and approval of bio-data changes. The mobile banking gateway stores PINs hashed and one-time codes only as hashes, locks a PIN after repeated wrong tries, binds members to devices with an SMS code and has an optional SIM-swap check that holds money movements after a swap, and the design keeps sensitive fields encrypted, with an append-only audit log. Those are design features, in a product in preview, and they have not been through an independent penetration test. The SACCO still owns the policy, the privacy notice and the decisions about retention.

Questions for your cloud ERP vendor and partner

• Where is the data hosted, and where are the backups?
• Who at the partner can see production member data, and how is that logged and approved?
• What is in the processing contract, and how is a breach reported to you?
• How do we export or delete member data when the law or a member requires it?

Talk to your own legal adviser about your obligations. SaccoFlow 365 is in preview and is introduced through a pilot with your data. To scope one, book a consultation.