Kenya's Regulatory Landscape at a Glance
Kenya's framework rests on the Data Protection Act and the 2021 Regulations, supervised by the Office of the Data Protection Commissioner. It follows the GDPR closely in structure while adding a threshold-based registration regime, and sectoral requirements in communications, financial services, and health apply alongside.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- Kenya
- Primary data protection framework
- Data Protection Act, No. 24 of 2019
- Key subordinate legislation
- Data Protection (General) Regulations 2021 and the Registration and Complaints Regulations
Key Regulations in Kenya
Data Protection Act, No. 24 of 2019
The Act gives effect to Article 31(c) and (d) of the Constitution, which protects the privacy of information relating to family or private affairs and the privacy of communications. It applies to data controllers and processors established or resident in Kenya who process personal data while in Kenya, and to those not established in Kenya who process the personal data of data subjects located in Kenya.
Its structure follows the GDPR closely, with principles of data protection, lawful bases, data subject rights, impact assessments, and breach notification.
Depending on applicability, organisations may need to address:
- The principles of data protection set out in the Act.
- A lawful basis for processing, including consent and legitimate interests.
- Stricter conditions for sensitive personal data.
- Registration with the ODPC where the thresholds apply.
- Appointment of a data protection officer where required.
- Data protection impact assessments for high-risk processing.
- Breach notification to the ODPC and affected data subjects.
- Conditions for transferring personal data outside Kenya.
Because the Act is constitutionally grounded, data protection arguments in Kenya can be framed as constitutional rights claims as well as statutory ones.
Registration with the ODPC
Data controllers and data processors must register with the Office of the Data Protection Commissioner unless they fall below the thresholds set in the Registration Regulations, which are based on annual turnover and the number of employees.
Registration is mandatory regardless of threshold for entities engaged in specified activities, which have included canvassing political support, crime prevention and prosecution, gambling, operating in sectors such as financial services, health, education and telecommunications, direct marketing, transport data, and processing genetic data.
Organisations assessing registration may need to consider:
- Whether annual turnover and employee numbers fall below the thresholds.
- Whether any mandatory activity category applies regardless of size.
- Separate registration as a controller, a processor, or both.
- Renewal of the certificate of registration.
- That operating without registration where required is an offence.
The activity-based categories override the size thresholds, so a small business in a listed sector must still register.
Data Protection (General) Regulations 2021
The General Regulations provide much of the operational detail, covering the exercise of data subject rights, the duties of controllers and processors, impact assessment requirements, conditions for processing sensitive personal data, direct marketing, and cross-border transfer requirements.
Areas addressed in the Regulations may include:
- Procedures and timeframes for data subject requests.
- Contractual requirements between controllers and processors.
- When an impact assessment is required and what it must cover.
- Commercial use of personal data and direct marketing consent.
- Transfer safeguards and the Commissioner's role in approving them.
Compliance is assessed against the Regulations as much as the Act, particularly on request handling and marketing.
Breach Notification
Where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the data subject, the controller must notify the Commissioner without delay and in any event within seventy-two hours of becoming aware, and communicate with the data subject in writing within a reasonable period.
Where notification to the Commissioner is made after seventy-two hours, it must be accompanied by reasons for the delay. A processor must notify the controller within forty-eight hours of becoming aware.
Organisations responding to an incident may need to consider:
- The seventy-two hour period for notifying the Commissioner.
- The forty-eight hour processor-to-controller notification period.
- Whether there is a real risk of harm to the data subject.
- Written communication to affected data subjects.
- A record of breaches regardless of whether they were notifiable.
The separate forty-eight hour processor obligation is specific to Kenya and should be reflected in processing agreements.
Cross-Border Transfers
Transfers of personal data outside Kenya are permitted where the controller or processor gives proof to the Commissioner of appropriate safeguards, including that the destination has commensurate data protection laws, or where the transfer is necessary on one of the grounds in the Act, or with the data subject's consent after being informed of the possible risks.
Additional conditions apply to sensitive personal data, and the Act contemplates that certain categories of data may be required to be processed through a server or data centre located in Kenya on grounds of strategic interest or public revenue.
Organisations transferring data out of Kenya may need to consider:
- Whether appropriate safeguards can be evidenced to the Commissioner.
- Whether the destination has commensurate data protection law.
- Which necessity ground or consent basis applies.
- Additional conditions for sensitive personal data.
- Whether any localisation requirement applies to their data category.
The localisation provision applies to categories designated on strategic interest grounds rather than generally, so status should be confirmed rather than assumed.
Sectoral and Related Legislation
Other legislation applies alongside the Act, including the Kenya Information and Communications Act, the Computer Misuse and Cybercrimes Act, the Access to Information Act, and sectoral requirements from the Central Bank of Kenya for financial institutions and from health legislation for patient data.
Sectoral considerations may include:
- Communications sector licensing and confidentiality obligations.
- Cybercrime offences relating to data and systems.
- Central Bank requirements for banks and payment providers.
- Digital credit provider requirements, including on customer data.
- Health records and patient confidentiality rules.
Digital lending has attracted particular regulatory attention in Kenya, including on the use of contact and device data.
Who Needs to Comply With Kenyan Data Protection Law?
The Data Protection Act and related requirements may apply to:
Organisations in Kenya
Data controllers and processors established or ordinarily resident in Kenya who process personal data while in Kenya.
International companies
Controllers and processors not established in Kenya who process the personal data of data subjects located in Kenya.
Organisations requiring registration
Entities above the turnover and employee thresholds, or in a mandatory activity category regardless of size.
Processors
Service providers acting on a controller's instructions, with their own registration, security, and forty-eight hour notification duties.
Employers
Organisations handling employee and candidate data, including health data treated as sensitive personal data.
Digital lenders and marketers
Businesses processing contact, device, or behavioural data for credit or marketing, an area of active ODPC attention.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under the Data Protection Act
Principles and Lawful Basis
Processing must comply with the Act's principles and rest on a lawful basis, which include consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a public task, and the legitimate interests of the controller.
Sensitive personal data requires a further condition in addition to the general lawful basis.
Registration
Controllers and processors must register with the Commissioner unless below the prescribed thresholds, and must register regardless of size where they fall within a mandatory activity category. Certificates must be renewed and processing without registration where required is an offence.
Data Protection Officer
A data protection officer must be designated where required, and the Act provides that a group of undertakings may appoint a single officer provided they are accessible from each establishment. The officer advises on compliance, monitors it, and acts as the contact point for the Commissioner.
The group appointment provision is helpful for multinationals and should be documented where relied upon.
Impact Assessments
Where processing is likely to result in a high risk to the rights and freedoms of a data subject, the controller must carry out a data protection impact assessment before processing, and may be required to submit it to the Commissioner.
Breach Notification
Breaches presenting a real risk of harm must be notified to the Commissioner without delay and within seventy-two hours of awareness, with reasons where later, and communicated in writing to affected data subjects within a reasonable period. Processors must notify controllers within forty-eight hours.
Transfers and Retention
Transfers outside Kenya require evidenced safeguards, a necessity ground, or informed consent, with additional conditions for sensitive personal data. Personal data must not be retained longer than necessary and must be deleted or anonymised when the purpose is served.
Data Subject Rights Under the Data Protection Act
The Act gives data subjects a number of rights over their personal data. Depending on the circumstances, these may include:
Right to Be Informed
Data subjects have the right to be informed of the use to which their personal data is to be put.
Right of Access
Data subjects may access their personal data held by a controller and information about the processing.
Correction and Deletion
Data subjects may request correction of false or misleading data and deletion of false, misleading, or unlawfully obtained data.
Objection
Data subjects may object to the processing of all or part of their personal data.
Data Portability
Data subjects may request transfer of their personal data to another controller in a structured, commonly used format.
Complaint and Compensation
Data subjects may complain to the Commissioner and may claim compensation for damage suffered through a breach of the Act.
The General Regulations set out the procedures and timeframes for responding to requests, which are generally shorter than one month.
Kenya's Regulatory Timeline
Kenya legislated in 2019 and built out its regulator and regulations quickly.
- November 2019
Data Protection Act Enacted
The Data Protection Act, No. 24 of 2019, was enacted to give effect to the constitutional right to privacy.
- November 2020
Commissioner Appointed
The first Data Protection Commissioner was appointed and the Office of the Data Protection Commissioner became operational.
- 2021
Regulations Issued
The General Regulations, Registration Regulations, and Complaints Handling Regulations came into effect, providing operational detail.
- 2022 onwards
Active Enforcement
The ODPC began issuing determinations on complaints and penalty notices, becoming one of the more active regulators in the region.
Important: registration thresholds, activity categories, and guidance continue to develop. Confirm the current requirements from official sources before changing your compliance programme.
Data Protection Authorities in Kenya
The Office of the Data Protection Commissioner (ODPC) administers the Act. It operates the registration system, issues guidance and advisories, receives breach notifications, investigates complaints and issues determinations, and can impose administrative penalties and enforcement notices. It has been notably active in publishing determinations.
Other authorities are relevant depending on sector, including the Communications Authority of Kenya, the Central Bank of Kenya for financial institutions and digital credit providers, and the Commission on Administrative Justice for access to information matters.
Determinations published by the ODPC are the most useful source on how Kenyan requirements are applied in practice.
Penalties for Non-Compliance
The Act's penalty cap is structured unusually. The Commissioner may impose an administrative penalty of up to five million Kenyan shillings, or in the case of an undertaking up to one per cent of its annual turnover of the preceding financial year, whichever is lower. Because the lower of the two applies, the turnover limb operates as a cap that reduces exposure for smaller undertakings rather than increasing it for larger ones.
The Commissioner may also issue enforcement notices requiring specified steps, and failure to comply is an offence. The Act creates offences including unlawful disclosure, obtaining access to personal data without authority, and providing false information to the Commissioner, with fines and imprisonment available. Data subjects may separately claim compensation for damage suffered through a breach of the Act.
How RegulatoryBridge Supports Compliance in Kenya
RegulatoryBridge helps organisations assess Kenya's regulatory requirements and coordinate their compliance activities with wider international programmes.
DPA Compliance Assessment
Review your processing activities, legal bases, notices, policies, governance arrangements, and operational controls to identify potential gaps.
Data Protection Officer and Registration Assessment
Review whether your organisation must register with the ODPC under the threshold criteria, and whether a data protection officer appointment is required.
Data Subject Rights
Review request-handling processes, response timelines, privacy notices, and related documentation against the requirements applicable to you.
Breach Response and ODPC Notification
Evaluate breach assessment procedures, escalation responsibilities, ODPC notification readiness, and coordination between privacy, security, and legal teams.
International Data Transfers
Assess transfers out of Kenya against the adequacy, safeguards, and consent routes, and the additional conditions applying to sensitive personal data.
Sectoral Compliance Coordination
Help organise requirements across the Data Protection Act, communications regulation, financial sector rules, and health sector requirements.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, ODPC guidance, or enforcement decisions change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to Kenya Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to Kenya.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions About Kenya Compliance
Need Kenyan Data Protection Act support?
We support your ODPC registration, data protection officer arrangements, and breach notification readiness - so your global product team doesn't have to.