🇰🇪Data Protection Act, 2019
A GDPR-style law with a Kenyan enforcement architecture
Kenya's Data Protection Act, 2019 is the country's core personal data protection law. It gives effect to Article 31(c) and (d) of the Constitution, establishes the Office of the Data Protection Commissioner, regulates the processing of personal data, creates rights for data subjects, and imposes obligations on data controllers and data processors.
The Act is recognisably modern and GDPR-influenced, but it should not be treated as a copy-paste GDPR framework. Kenya has its own structure: mandatory registration where thresholds apply, a statutory Data Commissioner with investigation and penalty powers, direct statutory duties on both controllers and processors, a specific breach notification timeline, transfer rules tied to proof of safeguards, and express provisions on commercial use of personal data. A Kenya compliance programme therefore has to be built around the Act itself, not around a generic global privacy template.
Who the Act covers — including non-Kenyan organisations
The Act applies to processing of personal data entered in a record by or for a data controller or processor, whether the processing is automated or non-automated. For non-automated records, the personal data must form part of a filing system. This means the Act reaches structured customer files, employee records, CRM systems, app databases, HR folders, financial records, health records, school records and other organised personal data systems.
The territorial scope is important. The Act applies where the data controller or processor is established or ordinarily resident in Kenya and processes personal data while in Kenya. It also applies where the controller or processor is not established or ordinarily resident in Kenya but processes personal data of data subjects located in Kenya. A foreign SaaS provider, edtech platform, fintech app, employer, research platform or marketing business cannot assume it is outside the Act merely because its servers, headquarters or contracting entity are outside Kenya.
The Act uses the familiar roles of data controller and data processor. A controller determines the purpose and means of processing. A processor processes personal data on behalf of the controller. But processors are not invisible subcontractors under the Act. They have direct obligations, can be audited, may be required to register where thresholds apply, must notify controllers of breaches, and can be liable for damage where they act outside the controller's lawful instructions or breach obligations directed at processors.
Registration is a front-door compliance requirement
Part III requires data controllers and data processors to register with the Data Commissioner where they meet the prescribed mandatory registration thresholds. In setting those thresholds, the Data Commissioner is required to consider the nature of the industry, the volume of data processed, whether sensitive personal data is processed, and any other specified criteria.
An application for registration must describe the personal data to be processed, the purpose of processing, the categories of data subjects, the contact details of the controller or processor, the general risks and safeguards, the security measures and mechanisms for protection, and any measures to indemnify the data subject from unlawful use of data. Once registered, the controller or processor must notify the Data Commissioner of changes to the registered particulars.
This matters operationally because registration is not just a licence number. It forces the organisation to define its data categories, purposes, risk profile, security posture and accountable contact points. A business that cannot accurately complete its registration particulars probably does not yet have a reliable privacy inventory.
The principles — the Act's operating discipline
Section 25 sets out the core data protection principles. Every controller or processor must ensure that personal data is processed in accordance with the data subject's right to privacy, processed lawfully, fairly and transparently, collected for explicit, specified and legitimate purposes, limited to what is necessary, accurate and kept up to date, retained no longer than necessary, and not transferred outside Kenya unless there is proof of adequate safeguards or consent from the data subject.
One Kenyan-specific drafting point should not be missed. Section 25 requires personal data to be collected only where a valid explanation is provided whenever information relating to family or private affairs is required. That is not a decorative requirement. It creates a practical obligation to justify why family details, marital information, dependants, household data or similar private affairs are being requested.
The principles are supported by specific duties across the Act: direct collection from the data subject as the default rule, notification before collection, lawful processing grounds, consent conditions, child data rules, restriction of processing, automated decision-making protections, commercial use rules, portability, retention limitation, rectification and erasure, privacy by design and breach notification.
Lawful processing — consent is important, but not the only basis
Section 30 allows processing where the data subject consents for one or more specified purposes, or where processing is necessary for one of the listed statutory grounds. These include performance of a contract, compliance with a legal obligation, protection of vital interests, tasks carried out in the public interest or exercise of official authority, public authority functions, other public functions, legitimate interests pursued by the controller or processor or a third party, and historical, statistical, journalistic, literary, artistic or scientific research purposes.
The legitimate interests basis is not unlimited. It is unavailable where the processing is unwarranted in a particular case having regard to the harm and prejudice to the rights and freedoms or legitimate interests of the data subject. This requires a real assessment, not a label. If the processing is intrusive, unexpected, sensitive, or likely to affect a vulnerable person, a generic legitimate interests statement will not be enough.
Where consent is used, the controller or processor bears the burden of proving that consent was obtained for the specified purpose. The data subject has the right to withdraw consent at any time, and the withdrawal does not affect processing that was lawful before withdrawal. In assessing whether consent was freely given, the Act specifically requires attention to whether a contract or service was made conditional on consent to processing that was not necessary for that contract.
Notice before collection — not just a privacy policy
Before collecting personal data, a controller or processor must, as far as practicable, inform the data subject of their rights, the fact of collection, the purpose of collection, third parties to whom the data has been or will be transferred and the safeguards adopted, the contacts of the controller or processor, whether another entity may receive the data, the technical and organisational security measures used to ensure integrity and confidentiality, whether collection is voluntary or mandatory, and the consequences of failing to provide the data.
This makes Kenya a notice-heavy jurisdiction. A long privacy policy can support compliance, but the collection point still matters. Forms, onboarding screens, employment documents, app sign-ups, loan applications, patient registration, school admissions and consent workflows must explain what is being collected, why it is needed, who may receive it, whether it is compulsory, and what happens if the data subject does not provide it.
Children, health data and sensitive personal data
The Act defines sensitive personal data broadly. It includes data revealing race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of children, parents, spouse or spouses, sex or sexual orientation. Processing sensitive personal data is subject to stricter grounds and safeguards.
Personal data relating to a child may not be processed unless consent is given by the child's parent or guardian and the processing protects and advances the rights and best interests of the child. Controllers and processors must incorporate appropriate age verification and consent mechanisms based on available technology, volume of personal data processed, the likely proportion of child data, possible harm to children, and other factors specified by the Data Commissioner. A limited exception exists for providers exclusively offering counselling or child protection services to a child.
Health data receives separate treatment. It may only be processed by or under the responsibility of a health care provider, by a person subject to professional secrecy, where necessary for reasons of public interest in public health, or by another person who owes a duty of confidentiality under law. Hospitals, clinics, insurers, wellness apps, employee health programmes and health-tech providers should therefore treat health data as a distinct compliance category, not as ordinary customer data.
DPIA, privacy by design and processor contracts
Where processing is likely to result in a high risk to the rights and freedoms of a data subject, the controller or processor must conduct a data protection impact assessment before the processing begins. The DPIA must describe the processing and purposes, assess necessity and proportionality, assess risks to data subjects, and identify measures, safeguards and mechanisms to address those risks and demonstrate compliance.
If the DPIA indicates that processing would result in high risk to rights and freedoms, the controller or processor must consult the Data Commissioner before processing. DPIA reports must be submitted sixty days prior to the processing of data. This is especially important for large-scale profiling, sensitive data processing, child data processing, health data systems, financial scoring, employee monitoring and automated decision-making.
The Act also requires data protection by design and by default. Appropriate technical and organisational measures must be built into the design and operation of processing, including minimisation by default, identification of foreseeable risks, safeguards against those risks, pseudonymisation and encryption where appropriate, ability to restore access after incidents, verification of safeguards, and continual updating of safeguards in response to new risks. Where a controller uses a processor, the controller must choose a processor that provides sufficient guarantees and enter into a written contract requiring the processor to act only on the controller's instructions and to be bound by controller-equivalent obligations. If a processor acts beyond those instructions, it is treated as a controller for that processing.
Breach notification — 72 hours for controllers, 48 hours for processors
Where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the data subject, the data controller must notify the Data Commissioner without delay and within seventy-two hours of becoming aware of the breach. If the notification is late, reasons for the delay must accompany it.
The controller must also communicate the breach to the data subject in writing within a reasonably practical period unless the identity of the data subject cannot be established. The communication should provide enough information for the data subject to take protective measures, including the nature of the breach, measures taken or intended, recommendations to mitigate adverse effects, the identity of the unauthorised person where applicable, and contact details of the DPO or other contact point.
A data processor that becomes aware of a personal data breach must notify the controller without delay and, where reasonably practicable, within forty-eight hours. The controller must record the facts relating to the breach, its effects and the remedial action taken. Encryption and other safeguards may remove the need to communicate the breach to the data subject where they adequately protect the affected data.
Transfers outside Kenya — proof, safeguards and consent
Personal data may be transferred outside Kenya only where the controller or processor has given proof to the Data Commissioner of appropriate safeguards for the security and protection of the personal data, including safeguards connected with jurisdictions that have commensurate data protection laws, or where one of the listed necessity grounds applies. These include contract performance, contracts in the interest of the data subject, public interest, legal claims, vital interests, or compelling legitimate interests not overridden by the rights and freedoms of data subjects.
Sensitive personal data receives an additional rule: processing sensitive personal data outside Kenya requires the consent of the data subject and confirmation of appropriate safeguards. The Data Commissioner may require a transferor to demonstrate the effectiveness of safeguards or the existence of compelling legitimate interests, and may prohibit, suspend or impose conditions on a transfer to protect the rights and fundamental freedoms of data subjects.
The Act also allows the Cabinet Secretary to prescribe certain types of processing that must be carried out through a server or data centre located in Kenya, based on strategic interests of the State or protection of revenue. Organisations using offshore cloud, regional hubs or global support teams should therefore map transfers and hosting separately.
A Nairobi-based digital lender collects national ID details, phone contacts, employment information, family details and repayment behaviour from thousands of users. It registers late, uses a generic privacy policy, and stores customer files with an offshore support vendor. After a support account is compromised, the lender waits several days before assessing whether the incident is notifiable. Under the Data Protection Act, this creates multiple compliance problems: registration particulars should have reflected the data categories, risks and safeguards; family and private affairs data required a valid explanation; the processor arrangement required a written contract and adequate safeguards; and if unauthorised access created a real risk of harm, the Data Commissioner had to be notified within seventy-two hours of awareness, with the processor expected to notify the controller within forty-eight hours where reasonably practicable.
Rights of data subjects
Data subjects have the right to be informed of the use to which their personal data will be put, to access personal data held by a controller or processor, to object to processing of all or part of their personal data, to correction of false or misleading data, and to deletion of false or misleading data about them.
The Act also gives data subjects portability rights. They may receive personal data concerning them in a structured, commonly used and machine-readable format, transmit it to another controller or processor without hindrance, and where technically possible have it transmitted directly from one controller or processor to another. Portability requests must be complied with at reasonable cost and within thirty days, subject to extension where the request is complex or numerous.
Automated decision-making is also regulated. A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects them, unless a statutory exception applies. Where such a decision is taken, the individual must be notified and may request reconsideration or a new decision that is not based solely on automated processing.
Commercial use of personal data
Section 37 creates a direct rule for commercial use. A person must not use personal data for commercial purposes unless express consent has been sought and obtained from the data subject, or the use is authorised by written law and the data subject was informed of that use at collection. Where possible, personal data used for commercial purposes should be anonymised so that the data subject is no longer identifiable.
This is significant for marketing, monetisation, analytics, data brokerage, lead generation, customer profiling and partner campaigns. A business cannot treat every collected dataset as a commercial asset merely because it lawfully collected the data for service delivery. Commercial use must be separately justified under the Act.
Enforcement, penalties and compensation
The Data Commissioner may investigate complaints, require attendance and production of documents, obtain information stored in electronic devices in visible and legible form, issue enforcement notices, seek assistance, obtain warrants for entry and search, issue penalty notices and impose administrative fines. Complaints are to be investigated and concluded within ninety days.
An enforcement notice must specify the provision contravened, the measures needed to remedy or eliminate the contravention, a period of not less than twenty-one days for implementation, and the right of appeal. Failure to comply with an enforcement notice is an offence punishable by a fine not exceeding five million shillings, imprisonment for a term not exceeding two years, or both. Obstructing the Data Commissioner carries the same maximum fine and imprisonment exposure.
Administrative fines may reach up to five million shillings or, for an undertaking, up to one percent of annual turnover of the preceding financial year, whichever is lower. A general offence under the Act for which no specific penalty is provided may attract a fine not exceeding three million shillings, imprisonment for a term not exceeding ten years, or both. A data subject who suffers damage because of a contravention is entitled to compensation, and damage includes financial loss as well as non-financial loss including distress.
Section 4 — Application: applies to controllers and processors in Kenya and to foreign controllers or processors processing personal data of data subjects located in Kenya.
Sections 8-9 — Functions and powers of the Data Commissioner: enforcement, investigations, inspections, complaints, audits, fines and international cooperation.
Sections 18-23 — Registration: mandatory registration where thresholds apply; registration particulars; public register; cancellation, variation, compliance and audits.
Section 24 — Data Protection Officer: designation or appointment for public bodies, systematic monitoring and sensitive personal data processing.
Section 25 — Principles: privacy, lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation and transfer safeguards.
Sections 26-27 — Data subject rights and exercise of rights by authorised persons, guardians or persons with parental authority.
Sections 28-30 — Collection, notification and lawful processing grounds.
Sections 31-32 — DPIA and consent: high-risk processing assessments, prior consultation, consent proof and withdrawal.
Section 33 — Child data: parental or guardian consent, best interests and age verification mechanisms.
Sections 35-38 — Automated decisions, objection, commercial use and portability.
Sections 39-43 — Retention, rectification, erasure, privacy by design, processor contracts and breach notification.
Sections 44-47 — Sensitive personal data and health data processing grounds.
Sections 48-50 — Transfers outside Kenya, safeguards, sensitive data transfers and possible local server or data centre requirements.
Sections 56-66 — Complaints, investigations, enforcement notices, penalty notices, administrative fines, appeals, compensation and preservation orders.
Sections 72-73 — Unlawful disclosure offences and general penalty.
Kenya's Data Protection Act is an operational compliance law. It expects organisations to know what personal data they hold, why they hold it, whether they must register, what notices they give, which lawful ground supports processing, how sensitive and child data are protected, whether high-risk processing needs a DPIA, how processors are controlled, where data is transferred, and how quickly breaches can be escalated. The organisations that will manage Kenyan data protection risk best are the ones that turn the Act into working systems: registration records, data maps, notices, contracts, DPIAs, transfer records, breach playbooks and rights workflows that can be shown to the Data Commissioner when asked.