🇰🇪Kenya

Kenya's data compliance framework is built around the Data Protection Act, 2019

Kenya's personal data protection regime is anchored in the Data Protection Act, 2019. The Act gives effect to the constitutional right to privacy, creates the Office of the Data Protection Commissioner, regulates the processing of personal data, gives enforceable rights to data subjects, and imposes duties on data controllers and data processors.

The framework is modern, rights-based and operational. It is not limited to privacy notices. Organisations must be able to identify their role, register where required, justify their collection and use of personal data, honour data subject rights, protect sensitive and child data, control processors, assess high-risk processing, manage breach notification, and govern transfers outside Kenya.

The three pillars to understand first

The Data Protection Act, 2019 answers the core legal question: when may personal data be processed, and what obligations apply to the controller or processor? It sets out principles of lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, retention limitation and transfer safeguards. It also defines the major rights of data subjects, including access, objection, correction, deletion, portability and protection from certain solely automated decisions.

The Office of the Data Protection Commissioner answers the enforcement and accountability question. The Data Commissioner maintains the register of data controllers and processors, oversees processing operations, receives and investigates complaints, carries out inspections, conducts assessments, issues enforcement notices, imposes administrative fines and may seek preservation orders where personal data is vulnerable to loss or modification.

The registration, DPIA, breach and transfer mechanisms answer the implementation question. Kenya does not merely ask organisations to have a privacy policy. It requires registration where thresholds apply, privacy-by-design measures, written controller-processor contracts, impact assessments for high-risk processing, notification of certain breaches to the Data Commissioner within seventy-two hours, processor escalation to controllers within forty-eight hours where reasonably practicable, and proof of safeguards for transfers outside Kenya.

How the Act applies

The Act applies to personal data processed by automated means and to non-automated processing where the personal data forms part of a filing system. This brings structured customer records, employee files, school records, patient records, financial records, platform data, app data and government datasets within the regime.

The territorial scope is broad. The Act applies to controllers and processors established or ordinarily resident in Kenya who process personal data while in Kenya. It also applies to organisations outside Kenya that process personal data of data subjects located in Kenya. This is especially important for foreign SaaS platforms, offshore processors, online education providers, payment businesses, fintech platforms, employers, cloud service providers and marketing companies serving Kenyan users.

Controllers, processors and DPOs

The Act distinguishes between a data controller, who determines the purpose and means of processing, and a data processor, who processes personal data on behalf of the controller. Both roles matter. Controllers carry primary responsibility for processing choices, but processors also have direct statutory exposure and can be liable if they breach processor-specific obligations or act outside lawful instructions.

The Act also provides for designation or appointment of a data protection officer where processing is carried out by a public body or private body, where core activities involve regular and systematic monitoring of data subjects, or where core activities involve processing sensitive categories of personal data. The DPO advises on compliance, supports staff capacity building, advises on DPIAs and cooperates with the Data Commissioner.

What organisations should prioritise

Start with role mapping and registration. Identify whether the organisation is a controller, processor or both; whether mandatory registration thresholds apply; what personal data categories are processed; what data subject categories are involved; what risks and safeguards exist; and whether registration particulars are accurate and current.

Then build the processing inventory around the Act's principles. For each activity, record the purpose, lawful basis, notice given to the data subject, whether collection is direct or indirect, whether consent is relied upon, whether the data includes sensitive or child data, whether family or private affairs data is requested, the retention period, processor involvement, transfer location and breach escalation route.

High-risk processing should be assessed early. DPIAs are required before processing likely to result in high risk to rights and freedoms, and reports must be submitted sixty days prior to processing. Activities involving profiling, large-scale sensitive data, child data, health data, credit scoring, behavioural monitoring, workplace surveillance or automated decisions should be screened for DPIA requirements.

Key compliance themes

Collection and notice: Personal data should generally be collected directly from the data subject. Before collection, the individual should be told the fact of collection, purpose, rights, recipients, safeguards, contacts, whether collection is voluntary or mandatory, and consequences of non-provision.

Lawful processing: Processing may rely on consent or another statutory necessity ground, including contract, legal obligation, vital interests, public interest, official authority, legitimate interests or research-related purposes. Consent must be provable, specific, free and informed, and may be withdrawn.

Sensitive and child data: Sensitive data is broadly defined and includes health, biometric, genetic, property, marital and family details. Child data requires parent or guardian consent and processing that protects and advances the child's rights and best interests, supported by appropriate age verification and consent mechanisms.

Security and breach response: Controllers and processors must implement appropriate technical and organisational measures. Controllers must notify the Data Commissioner within seventy-two hours of becoming aware of a breach involving unauthorised access or acquisition and real risk of harm. Processors must notify controllers without delay and, where reasonably practicable, within forty-eight hours.

Transfers outside Kenya: Transfers require proof of appropriate safeguards or a recognised necessity ground. Sensitive personal data processed outside Kenya requires data subject consent and confirmation of safeguards. The Data Commissioner may require proof of the safeguards and may prohibit, suspend or impose conditions on transfers.

Commercial use: Personal data cannot be used for commercial purposes unless express consent has been obtained or the use is authorised by law and was disclosed at collection. Where possible, commercial use should rely on anonymised data.