# When does a mental health service need a data protection impact assessment?

URL: https://tymirahealth.com/resources/faqs/when-does-a-mental-health-service-need-a-data-protection-impact-assessment
For: Executives | Data protection and privacy | Reviewed by Independent clinical reviewer, Registered mental health clinician, Kenya | Last reviewed 8 November 2026

**Answer:** Kenya's Data Protection (General) Regulations 2021 require a data protection impact assessment (DPIA) before processing that is likely to pose a high risk, and the ODPC's health data guidance covers when and how to submit one. Mental health records are sensitive personal data, so new systems, telehealth services, data sharing with employers or donors, and research projects usually need one. The Digital Health regulations also ask for a DPIA report when you connect a system to the national health data exchange.

Sources: Office of the Data Protection Commissioner: https://d4daccess.eu/sites/default/files/2024-02/ODPC-Guidance-Note-on-Processing-of-Health-Data.pdf - Kenya Law: https://new.kenyalaw.org/akn/ke/act/ln/2025/77/eng@2025-04-11 - Kenya Law: https://new.kenyalaw.org/akn/ke/act/2019/24/eng@2022-12-31 - Kenya Law: https://new.kenyalaw.org/akn/ke/act/2019/24/eng%402022-12-31 - Office of the Data Protection Commissioner: https://www.odpc.go.ke/guidelines-2 - Office of the Data Protection Commissioner: https://www.odpc.go.ke/wp-content/uploads/2024/02/ODPC-Guidance-Note-on-Data-Protection-Impact-Assessment-1.pdf - Kenya Law: https://new.kenyalaw.org/akn/ke/act/ln/2025/76/eng@2025-04-11

## Related questions

- [Can clinics in Kenya store patient data on cloud servers outside Kenya?](https://tymirahealth.com/resources/faqs/can-clinics-store-patient-data-outside-kenya)
- [Can employers screen staff for mental health conditions?](https://tymirahealth.com/resources/faqs/can-employers-screen-staff-for-mental-health-conditions)
- [Does a clinic need to register with the ODPC?](https://tymirahealth.com/resources/faqs/does-a-clinic-need-to-register-with-the-odpc)

---

**About Tymira Health:** Tymira Health is a healthcare technology company based in Nairobi, Kenya. It builds Tymira360, a practice management and EHR platform for mental health, physiotherapy and dental providers, clinics, hospitals, NGOs and insurers across Africa.

- Book a demo: https://tymirahealth.com/demo
- Contact: https://tymirahealth.com/contact (info@tymirahealth.com)
- All resources: https://tymirahealth.com/resources/all