MNL ADVOCATES LLP (MN LEGAL)

Blog

  • The Privacy Evidence Pack: What to Build, Measure, and Show in 2026

    The Privacy Evidence Pack: What to Build, Measure, and Show in 2026

    Updated guidance for organisations on building a defensible data protection record: what to document, what to measure, and what to show regulators, partners, and customers.

    In 2026, data protection compliance is no longer judged by what your privacy policy says. It is judged by what you can prove on demand: decisions, controls, logs, contracts, and records. Organisations that cannot produce a credible privacy evidence pack quickly will struggle under regulator questions, enterprise procurement scrutiny, or post-incident review.

    Bottom line: Build a privacy evidence pack that lets you answer due diligence and audit questions fast, without scrambling across email threads and spreadsheets.

    Contents

    1. What a privacy evidence pack is and why it matters in 2026
    2. The 10 privacy artifacts every organisation should have
    3. Cross-border data transfers: document it in 5 steps
    4. AI and privacy: 7 controls for teams using AI tools
    5. How to run privacy as a system: cadence and KPIs
    6. FAQ

    1. What a Privacy Evidence Pack Is and Why It Matters in 2026

    A privacy evidence pack is the set of materials that demonstrate how your organisation manages personal data in practice, not just in policy. It is what makes data protection auditable and defensible internally (board oversight), externally (partners and enterprise customers), and regulator-facing (when questions arise).

    This matters globally because privacy regimes differ in their details but converge on a shared expectation: accountability, transparency, and demonstrable controls. Whether you are subject to Kenya’s Data Protection Act, the GDPR, or equivalent frameworks, the evidence standard is broadly the same.

    2. The 10 Privacy Artifacts Every Organisation Should Have (2026)

    If you want a documentation standard that travels well across jurisdictions, focus on artifacts that satisfy multiple regulatory frameworks simultaneously. These ten items form a practical baseline for any organisation handling personal data.

    Privacy evidence pack checklist 2026: 10 essential data protection artifacts for organisations
    Use this as your internal index: each missing item is a documented gap to close before an audit or due diligence request.

    What “Good” Looks Like Across All 10 Artifacts

    • Owned: each artifact has a named owner and a defined review cadence.
    • Current: updated whenever vendors, products, or data flows change.
    • Provable: you can show records and decisions, not just policy statements.

    3. Cross-Border Data Transfers: Document It in 5 Steps

    Most organisations transfer personal data across borders without recognising it as a transfer. Cloud hosting, CRMs, helpdesks, analytics platforms, marketing tools, and AI vendors can all create cross-border data flows that require documentation and appropriate safeguards.

    Cross-border data transfer documentation framework: five-step approach for privacy compliance
    A practical five-step method to map and document cross-border data flows without overcomplicating the process.

    Practical Tip

    Start with your top ten vendors ranked by data sensitivity and volume. Do not attempt to perfect the entire map at once. Get a defensible baseline documented first, then iterate as you onboard new tools or expand into new markets.

    4. AI and Privacy: 7 Controls for Teams Using AI Tools

    In 2026, many organisations face a data protection risk that did not exist at the same scale a few years ago: everyday data leakage into AI tools through prompts, file uploads, meeting notes, transcripts, and customer tickets. AI adoption also increases vendor complexity and creates new cross-border transfer obligations.

    AI and data protection: seven privacy controls for organisations using AI tools in 2026
    These AI privacy controls are designed to be genuinely adoptable by operational teams and designed to be used, not written and ignored.

    Minimum Documentation for AI Use

    • AI use register: tool name, purpose, owner, data input types, and risk classification.
    • Data entry restrictions: a clear record of what categories of data cannot be entered into external AI tools.
    • Vendor controls: data retention terms, training-use clauses, incident notification obligations, and sub-processor lists.

    5. How to Run Privacy as a System: Cadence and KPIs

    Monthly Review

    • Vendor changes and newly adopted tools, especially AI tools.
    • New processing activities arising from product or service changes.
    • Open data subject rights requests and incident log review.

    Quarterly Review

    • High-risk processing review: DPIAs and PIAs for new or changed activities.
    • Cross-border transfer review for top vendors.
    • Board and leadership privacy report covering risks, incidents, and remediation status.

    KPIs That Are Practical to Track

    • Average time to complete data subject rights requests.
    • Percentage of critical vendors with signed DPAs and documented transfer safeguards.
    • Time-to-triage for incidents and time-to-close for remediation actions.
    • Percentage of teams trained and completion rate of AI-use controls.

    Need This Implemented in Your Organisation?

    MN Legal supports privacy evidence-pack readiness, vendor and cross-border transfer contracting, AI governance controls, and breach readiness so your organisation can demonstrate compliance efficiently when it matters most.

    Make an enquiry  |  Explore Practice Areas

    Key References

    Frequently Asked Questions

    What is a privacy evidence pack?

    A privacy evidence pack is the set of documents, logs, and records that prove how your organisation manages personal data in practice, going beyond policy statements alone. It typically includes your processing register, DPIAs, vendor DPAs, incident log, data subject rights log, retention schedule, and staff training records.

    Does our organisation need a DPIA?

    A DPIA is most valuable when processing is likely to create high risk for individuals. For example, large-scale processing of sensitive data, profiling, automated decision-making, or the use of new technologies. It is also strong evidence that you assessed risks and implemented appropriate controls before processing began.

    How should we handle cross-border data transfers in 2026?

    Map your transfers by system, vendor, and destination country. Identify the legal mechanism and safeguards applicable to each transfer, document your risk assessment, ensure appropriate contractual clauses are in place, and maintain an evidence trail of approvals and periodic reviews.

    What should we do about staff using AI tools with personal data?

    Maintain an AI use register, establish clear restrictions on what data categories may be entered into external tools, implement vendor procurement and contractual controls, require human review for high-impact AI outputs, and keep an audit trail for high-risk use cases.

    What do regulators and procurement teams ask for during due diligence?

    Common requests include your processing register, privacy notices, completed DPIAs, vendor DPAs and transfer documentation, a security measures summary, your incident response plan and incident log, and records of data subject rights requests and staff training completion.

    How can MN Legal help with data protection compliance?

    MN Legal supports privacy programme design and evidence-pack readiness, vendor and cross-border transfer contracting, AI governance controls, and incident readiness so organisations can demonstrate compliance efficiently when facing regulators, partners, or post-incident scrutiny.

    Disclaimer: This article is for general information only and does not constitute legal advice. Requirements vary by jurisdiction and specific facts. For advice on your organisation’s situation, contact MN Legal.

    Download: Privacy Evidence Pack Checklist (2026)

    A one-page index of the 10 artifacts and logs your organisation should be able to produce on demand. Built for international organisations operating across multiple jurisdictions.

    Download PDF Checklist
  • How Kenyan courts scrutinise listed-company transactions

    How Kenyan courts scrutinise listed-company transactions

    Listed-company transactions in Kenya increasingly require an evidence-backed compliance and governance record.

    Kenyan Courts and the Oversight of Transactions Involving Listed Companies

    Updated guidance for boards, sponsors, and advisers on judicial restraint, minority shareholder risk, and defensible process in Kenyan capital markets transactions.

    The judicial oversight of transactions involving publicly listed companies in Kenya is undergoing a quiet but significant shift. For much of Kenya’s corporate law history, courts adopted a posture of restraint intervening only where clear illegality, fraud, or contractual breach was demonstrated. Recent litigation signals a gradual recalibration: Kenyan courts are increasingly willing to scrutinise listed-company transactions where regulatory compliance, minority shareholder protection, and public interest are implicated.

    Key point: Courts may avoid disrupting markets at the interim stage, but listed-company transactions are not immune from judicial scrutiny where credible regulatory or constitutional issues are raised.

    Contents

    1. Context: the courts’ historical restraint
    2. The Diageo–EABL petition as a lens
    3. Interlocutory posture: restraint vs scrutiny
    4. What Kenyan courts are increasingly willing to scrutinise
    5. Minority shareholders and “quasi-public” listed companies
    6. Practical guidance for boards and deal teams
    7. Key references
    8. FAQ

    1. Context: The Courts’ Historical Restraint in Commercial Matters

    Kenyan jurisprudence has long recognised the need for judicial caution in commercial matters. Courts have consistently warned against undue interference with market activity particularly where such interference may disrupt commercial certainty or investor confidence. This principle remains intact.

    The practical logic is straightforward: interim orders can effectively determine a transaction before parties are fully heard, and can create market instability especially where listed securities and dispersed investors are involved.

    2. The Diageo–EABL Petition as a Lens on Capital Markets Oversight

    The petition challenging Diageo Plc’s proposed disposal of its majority shareholding in East African Breweries Limited (EABL) provides a useful lens through which to examine the courts’ emerging role in capital markets oversight in Kenya.

    The impugned transaction concerns the proposed disposal by Diageo Plc of its controlling interest in EABL — a company listed on the Nairobi Securities Exchange (NSE). A petition was lodged seeking, among other reliefs, orders restraining the transaction on grounds of alleged non-compliance with statutory and regulatory requirements governing changes in corporate control of listed companies.

    3. Interlocutory Posture: Judicial Restraint Does Not Equal Abdication

    At the interlocutory stage, the High Court declined to grant prohibitory relief and instead postponed the hearing for further directions. While no determination was made on the merits, the Court’s approach is instructive in understanding contemporary judicial attitudes toward complex commercial transactions involving listed entities.

    By declining to issue immediate restraining orders, the Court reaffirmed the importance of preserving transactional stability pending a full hearing.

    However, restraint does not equate to abdication. The Court’s willingness to entertain the petition and defer the matter for further consideration underscores a clear recognition: transactions involving listed companies are not immune from judicial scrutiny particularly where allegations of regulatory non-compliance or constitutional violations are raised.

    4. What Kenyan Courts Are Increasingly Willing to Scrutinise

    A notable feature of recent litigation is the increasing justiciability of corporate transactions traditionally regarded as private commercial affairs. Kenyan courts have demonstrated readiness to interrogate:

    • Compliance with capital markets and corporate governance regulations
    • Procedural propriety in the obtaining of regulatory approvals
    • Protection of minority shareholder interests
    • Constitutional principles including transparency, accountability, and fair administrative action
    Six triggers that attract judicial scrutiny in Kenyan listed-company transactions
    Common triggers that can attract judicial scrutiny in listed-company transactions in Kenya.

    5. Minority Shareholders and the Quasi-Public Nature of Listed Companies

    The Court’s approach suggests that regulatory compliance is no longer viewed as an exclusively administrative concern it is one capable of judicial evaluation where public interest considerations arise.

    The growing prominence of minority shareholders in litigation involving listed companies marks a significant development in Kenyan corporate law. Courts appear increasingly receptive to arguments that transactions affecting control of listed entities engage broader public and investor interests beyond the contracting parties.

    This trend aligns with constitutional values and the evolving understanding of corporate governance in capital markets, where listed companies occupy a quasi-public position by virtue of their dispersed ownership and market participation.

    6. Practical Guidance for Boards and Deal Teams

    The takeaway for deal teams is not that courts will routinely stop transactions. It is that deal documentation and process should be built to withstand scrutiny if challenged.

    A) Build an Approvals Map Early

    • Document the approvals pathway board, shareholder, and regulator steps where applicable.
    • Maintain a clean record of submissions and key decision points.
    • Align internal authorisations with transaction timelines and disclosure obligations.

    B) Treat Governance Evidence as Deal-Critical

    • Keep board papers and minutes that show rationale, risk consideration, and oversight.
    • Document how conflicts are identified and managed.
    • Maintain a single deal file with supporting evidence — not scattered email threads.

    C) Plan for Minority Shareholder Scrutiny

    • Stress-test fairness and disclosure arguments before announcements are made.
    • Ensure communications are consistent across channels and documents.
    • Anticipate interim applications and prepare a defensible narrative of compliance and process.
    Deal-team checklist for listed-company transactions in Kenya — approvals, governance, disclosure, litigation readiness
    A deal-team checklist to strengthen defensibility and reduce process risk in listed-company transactions.

    Need Deal Counsel on a Listed-Company Transaction in Kenya?

    MN Legal advises on transaction structuring, approvals pathways, governance documentation, and litigation risk management for transactions involving regulated or listed entities in Kenya and across East Africa.

    Make an enquiry  |  Explore Practice Areas

    Key References

    Related MN Legal pages: Practice Areas and Contact.

    Frequently Asked Questions

    Can Kenyan courts stop a transaction involving a listed company?

    Yes, courts can grant interim or final relief in appropriate cases. They generally exercise caution to avoid destabilising markets, but may intervene where credible illegality, regulatory non-compliance, or procedural unfairness is alleged.

    Does regulatory approval prevent court scrutiny of a listed-company transaction?

    Regulatory approval is significant, but it does not automatically insulate a transaction from challenge — especially where constitutional principles or procedural fairness issues are raised.

    Why are minority shareholders increasingly relevant in listed-company disputes in Kenya?

    Listed companies have dispersed ownership and broad public participation. Kenyan courts may treat certain control-related transactions as implicating wider investor and market integrity concerns beyond the contracting parties.

    What documentation reduces litigation risk in listed-company transactions?

    A defensible approvals map, clear board papers and minutes, consistent disclosures, and a complete record of compliance steps and key decisions are often critical to withstanding challenge.

    What is the biggest interim-stage risk for deal teams in Kenya?

    Interim applications that delay closing or disrupt markets. Strong process evidence and consistency in disclosure reduce vulnerability to urgent injunctive relief at the interlocutory stage.

    When should legal counsel be engaged on a listed-company transaction in Kenya?

    Early during structuring and approvals planning. Early involvement improves process quality, reduces rework, and strengthens the defensibility of the transaction record.

    Disclaimer: This case comment is provided for academic and professional discussion only and does not constitute legal advice.