Data Protection & Privacy Centre › About Data Protection
The Co-operative University of Kenya
About Data Protection
This page sets out what the University means by personal data, sensitive personal data, processing, and privacy, with examples drawn from University activities. For what the University specifically collects, why, and what can be required of it, see the Privacy Notice.
Key terms
These terms are used throughout this Centre and in the University's privacy notices and policies.
Personal data
Personal data is any information that relates to an identified or identifiable living person — what the law calls a "data subject." It includes obvious things like a name, a national ID or passport number, a phone number, or a photograph. It also includes less obvious things: an IP address logged when you use the student portal, or a car's number plate recorded at a campus gate.
Sensitive personal data
The Data Protection Act, 2019 recognises a special category — sensitive personal data — that needs extra protection because misuse could cause real harm. This includes health data, genetic and biometric data, data revealing ethnic or social origin, religious or political belief, and, specifically under Kenyan law, family details and property details.
Processing
"Processing" is deliberately broad in law. It means anything done to personal data — collecting it, storing it, using it, sharing it, or destroying it. If a lecturer downloads a class list to record marks, that is processing. If a graduate's account is deleted years after graduation under the retention schedule, that is processing too — and it must be lawful.
Privacy
Privacy is the reasonable expectation that a person has some control over information about themselves — who can see it, how it is used, and for how long it is kept. Article 31 of the Constitution of Kenya, 2010 protects this as a fundamental right. Data protection law is the practical machinery that makes that constitutional right real in everyday university life.
Why this matters across the University
The Co-operative University of Kenya is built on co-operative values — trust, mutual benefit, and member accountability. Those values extend to how the University treats personal information, across every part of the institution.
Students
Your grades, discipline records and financial aid details are not casually shared or discussed between offices that have no reason to see them.
Staff
Your HR file, medical information and disciplinary history are held confidentially and used only for legitimate employment purposes.
Alumni
We contact you for genuine engagement and verification — not because your data was sold or carelessly handled after you graduated.
Researchers & participants
The people who trust a researcher with their data are protected by proper ethics review, secure storage, and honest, specific consent.
Parents & guardians
We discuss a student's records with you only where the student has consented or the law permits it — even where you are the one paying the fees.
Suppliers & contractors
The personal data of your staff and directors, shared with us for contracting purposes, is used only for that purpose.
Visitors
CCTV footage of your visit to campus is retained only as long as necessary and only for security purposes.
Everyone
Getting this right protects people from harm, protects the University from regulatory and reputational risk, and — most simply — is the right thing to do.
Related pages
The Privacy Notice sets out what the University collects, on what basis, and for how long. Your Rights sets out what can be required of the University, and how.
Contact the Data Protection Office
Questions about anything on this page, or about data protection at the University more generally, are welcome — this office exists to answer them.
Contact the Data Protection Office- dpo@cuk.ac.ke
- Telephone
- +254 724 311 606
- Address
- The Co-operative University of Kenya
Karen, Nairobi
P.O. Box 24814–00502, Nairobi