Data Protection in Pharmacovigilance: DPA 2019 & Digital Health Act
Pharmacovigilance data — patient-level ADR reports in particular — sits squarely at the intersection of PPB regulatory requirements and Kenya's broader data protection framework. MAHs need to satisfy both simultaneously, and they don't always point in the same direction.
What the Data Protection Act 2019 requires Any system processing personal data — including patient details embedded in ADR reports — needs to comply with DPA 2019 principles: lawful processing, purpose limitation, and appropriate security safeguards. Companies handling this data are expected to be registered with the Office of the Data Protection Commissioner (ODPC) as data processors or controllers as applicable.
Where the Digital Health Act 2023 adds a layer The Digital Health Act introduces additional considerations specifically for health-related digital systems, with implications for how health data — including PV-related patient information — is stored, and increasing attention on data localization.
The data localization tension A recurring practical challenge for Kenyan MAHs using cloud-based PV platforms: many popular backend providers don't operate infrastructure within Kenya or the wider East African region, raising questions about where sensitive health data is ultimately hosted and processed relative to local regulatory expectations.
What this means for choosing a PV platform MAHs should ask any PV software vendor directly where data is hosted, whether ODPC registration has been completed, and how the platform handles data subject rights under DPA 2019 — not assume compliance because a platform is otherwise well-built.
PvSentinel's approach to data protection and ODPC compliance
FAQ
Does every MAH need to register with the ODPC? Any entity processing personal data as part of its operations, including PV data, generally needs to consider ODPC registration obligations under DPA 2019. Is patient data in ADR reports considered sensitive personal data? Health-related personal data typically receives heightened protection under DPA 2019, warranting stricter safeguards than general business data.