How your organization
handles data matters now.
East Africa's data protection era has begun. Measure your organization's PDPA readiness, identify critical non-compliant practices, and get a clear remediation roadmap in 15 minutes.
What the PDPA requires of your organization
East Africa's data protection landscape is consolidating fast. Tanzania's Personal Data Protection Act (2022), Kenya's Data Protection Act (2019), and Uganda's PDPA (2019) share a common framework modeled on GDPR.
Any organization collecting, processing, or sharing personal data of East African residents is subject to these mandates regardless of where the organization is registered.
Non-compliance exposes your organization to regulatory fines, mandatory audits, and reputational damage that can permanently affect customer trust.
6 Compliance Dimensions
The assessment evaluates your organization across every dimension required by the Personal Data Protection Act and regional data governance frameworks.
Lawful Basis & Consent
Do you have documented consent for every personal data collection point? Are consent records time-stamped and auditable?
Data Subject Rights
Can individuals access, correct, or delete their data upon request within mandated timelines? Is there a formal rights-request workflow?
Breach Notification
Is there a documented breach detection, containment, and 72-hour regulatory notification process? Who owns it?
Data Retention & Disposal
Are retention schedules defined per data category? Is there a verified process for secure deletion when retention periods expire?
Processor Agreements (DPAs)
Do all third-party vendors who handle your customers' data have signed Data Processing Agreements in place?
Cross-Border Transfers
Is personal data transferred outside East Africa with documented adequacy decisions or safeguards (SCCs, BCRs)?
What You'll Receive
After completing the 30-question assessment, our compliance engine generates a comprehensive PDPA readiness package tailored to your sector.
01. PDPA Maturity Score
Your compliance level (0-5) benchmarked against East African businesses in your sector, with specific evidence points for each assessment dimension.
02. Non-Compliant Practice Audit
A precise inventory of non-compliant data practices organized by severity, with regulatory citations for each identified gap under the PDPA framework.
03. Remediation Priority Plan
A phased 90-day roadmap resolving critical gaps first, with effort estimates and suggested ownership for each remediation task.
04. Policy & DPA Template Kit
Customizable templates for a PDPA-compliant privacy notice, data processing agreement, subject rights request form, and breach notification protocol.
05. Compliance Strategy Session
A free 45-minute session with an Ondi PDPA advisor to walk through your maturity report and define the first sprint of remediation work.
Start your assessment
30 targeted questions. 15 minutes. A complete PDPA compliance picture with everything you need to act.
PDPA Compliance Levels 0-5
The assessment places your organization at one of six maturity levels. Each level corresponds to specific practices, risks, and a clear pathway to the next stage.
Find your levelLevel 0
No AwarenessNo formal data protection policies. Personal data collected and processed without documented legal basis or consent.
Level 1
Awareness OnlyLeadership is aware of PDPA requirements but no formal policies, registers, or processes exist. Compliance is ad-hoc.
Level 2
Basic PoliciesA privacy policy exists but is poorly enforced. No data inventory, inconsistent consent collection, no breach plan.
Level 3
Partial ComplianceFormal data protection program in progress. Data inventory exists, consent is captured, but gaps remain in third-party risk and subject rights.
Level 4
Monitored ComplianceMostly compliant. Privacy-by-design in product builds, regular DPIAs, DPAs with all vendors, active breach monitoring.
Level 5
Certified & AuditedFull PDPA compliance. Independently audited, Data Protection Officer appointed, zero-gap regulatory posture.
Data protection is no longer optional for East African businesses.
Enforcement is accelerating. Regulators in Tanzania, Kenya, and Uganda are actively issuing compliance notices and fines. The question is no longer if your organization will face scrutiny, but whether you will be ready when it arrives.
The Ondi PDPA Assessment gives you an objective baseline in 15 minutes, showing exactly which practices are compliant, which are not, and the minimum viable actions needed to close the gap before regulators arrive.
No consent records?
Collecting personal data without documented, auditable consent is a PDPA Level 0 risk. Regulators can act immediately.
Ignoring subject requests?
Failing to respond to data access or deletion requests within 30 days violates PDPA Section 18, triggering formal complaints.
No breach notification plan?
A 72-hour notification window starts the moment a breach is detected. No plan means automatic non-compliance with PDPA Section 26.
Vendors without DPAs?
Every third-party processor handling your customer data must have a signed Data Processing Agreement. Missing even one is a liability.
Know your compliance posture before your first regulator inquiry.
Get a PDPA maturity score, non-compliant practice audit, remediation plan, and policy template kit. No signup required to start.