Kenya Data Protection Act

What is Kenya’s Data Protection Act?

Kenya’s Data Protection Act, 2019 gives effect to the constitutional right to privacy. It sets GDPR-like principles and rights, supported by regulations issued in 2021 on general duties, registration of data controllers and processors, and compliance and enforcement.

Who does it apply to?

Data controllers and processors established or resident in Kenya, and those outside Kenya that process personal data of data subjects located in Kenya.

Key duties

• Registration: controllers and processors must register with the ODPC unless exempt. The Registration Regulations set turnover and employee thresholds and list sectors that must register regardless.
• Principles: lawfulness, fairness and transparency; purpose limitation; minimisation; accuracy; storage limitation; security; and restrictions on transfer.
• Lawful bases: consent and other grounds, with extra conditions for sensitive personal data, such as health, genetic, biometric, ethnic and property details.
• Rights: to be informed, to access, to object, to correct and to erase, and rights relating to automated decisions.
• Data protection impact assessments for processing likely to result in high risk.
• Breach notification: notify the Data Commissioner within 72 hours of becoming aware of a breach that creates a real risk of harm, and inform affected data subjects.
• Transfers abroad: only with proof of appropriate safeguards, adequacy or other conditions in the Act.

Enforcement

The ODPC can issue enforcement notices and penalty notices of up to KES 5 million or 1% of annual turnover, whichever is lower, and has published enforcement decisions against organisations.

How does it relate to other frameworks?

The Act’s structure closely follows the GDPR, so GDPR programmes adapt well. Registration and Kenya-specific breach and transfer procedures need local attention.