Kenya's Data Protection Act Explained: Rights, Obligations, and Penalties

Personal data is one of the most valuable assets in today's economy, and one of the most regulated. The Data Protection Act, 2019 (DPA) gives effect to the right to privacy under Article 31 of the Constitution of Kenya and sets strict rules on how organisations collect, use, store and share personal data. It applies to businesses, schools, hospitals, Saccos, digital lenders, NGOs and government bodies alike. This guide explains the rights the Act gives individuals, the obligations it places on organisations, and the penalties for getting it wrong.

Key takeaways

The DPA applies to any organisation that processes personal data of people in Kenya, including foreign organisations.
Most data controllers and processors must register with the Office of the Data Protection Commissioner (ODPC).
Individuals have enforceable rights, including access, correction, deletion and objection.
Data breaches must be reported to the Data Commissioner within 72 hours of becoming aware of them.
The ODPC can impose administrative fines of up to KES 5 million or 1% of annual turnover, whichever is lower, and courts can award compensation.

Who the Act applies to

The DPA applies to data controllers (who decide why and how personal data is processed) and data processors (who process data on a controller's behalf). It covers processing by automated and manual means, by organisations established in Kenya, and by organisations outside Kenya that process the personal data of data subjects located in Kenya.

"Personal data" means any information relating to an identified or identifiable natural person, such as a name, ID number, phone number, location data or online identifier. "Sensitive personal data" includes data revealing race, health status, ethnic origin, conscience, belief, genetic and biometric data, property details, marital status, family details, sex and sexual orientation. Sensitive data attracts additional safeguards.

The data protection principles

Section 25 of the Act requires personal data to be:

processed in accordance with the right to privacy;
processed lawfully, fairly and in a transparent manner;
collected for explicit, specified and legitimate purposes and not further processed in an incompatible way;
adequate, relevant and limited to what is necessary;
collected only where a valid explanation is provided for information relating to family or private affairs;
accurate and kept up to date;
kept in a form that identifies individuals for no longer than necessary; and
not transferred outside Kenya unless there is proof of adequate safeguards or the data subject's consent.

Rights of data subjects

Right	What it means in practice
Right to be informed	Individuals must be told how their data is used, usually through a privacy notice
Right of access	Individuals can request a copy of the personal data held about them
Right to object	Individuals can object to processing of all or part of their data, including for direct marketing
Right to correction	Inaccurate or misleading data must be corrected
Right to deletion	False, misleading or unlawfully held data must be deleted
Right to data portability	Individuals can receive their data in a structured, machine-readable format and transfer it to another controller
Rights on automated decisions	Individuals can, in most cases, refuse to be subject to decisions based solely on automated processing that significantly affect them

Key obligations for organisations

Registration with the ODPC

Under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, registration is mandatory for controllers and processors that meet the prescribed thresholds (broadly, more than 10 employees and annual turnover above KES 5 million) and, regardless of size, for organisations in listed sectors such as healthcare, education, financial services, telecommunications, real estate, transport, direct marketing and businesses that process genetic data. Registration must be renewed periodically.

Lawful basis and consent

Processing must rest on a lawful basis, such as consent, the performance of a contract, a legal obligation, vital interests, a public interest task or legitimate interests. Where consent is relied on, it must be express, unequivocal, free, specific and informed, and the organisation bears the burden of proving it. Consent can be withdrawn at any time.

Data protection by design and by default

Organisations must build data protection into systems and processes from the start, using measures such as pseudonymisation, encryption, access controls and data minimisation.

Data protection impact assessments

A DPIA is required where processing is likely to result in a high risk to the rights and freedoms of individuals, for example large-scale processing of sensitive data, systematic monitoring or the use of new technologies. In 2021, the High Court held that the government's rollout of the Huduma Namba digital ID system without a prior DPIA was unlawful, highlighting the importance of this requirement.

Data protection officers

Organisations whose core activities involve large-scale or regular and systematic monitoring of individuals, or large-scale processing of sensitive data, should designate a data protection officer.

Data processors and contracts

Controllers must use processors that provide sufficient guarantees and must put a written contract in place requiring the processor to act only on instructions, keep data secure and assist with compliance.

Breach notification

Where personal data is accessed or acquired by an unauthorised person and there is a real risk of harm, the controller must notify the Data Commissioner within 72 hours of becoming aware of the breach and must notify affected individuals within a reasonably practical period, unless their identity cannot be established. Processors must notify the controller without delay.

Cross-border transfers

Personal data can be transferred outside Kenya only where there are appropriate safeguards, the destination offers adequate protection, the transfer is necessary for specified reasons, or the data subject has consented. Sensitive personal data requires consent and confirmation of appropriate safeguards. The Cabinet Secretary may also require certain data to be processed on servers or data centres in Kenya on grounds of strategic interest.

Direct marketing

Personal data may be used for direct marketing only with consent or where the person has been given a simple way to opt out. Unsolicited marketing by SMS, email or calls remains a frequent source of complaints to the ODPC.

Enforcement and penalties

The ODPC handles complaints, conducts investigations and can issue enforcement notices and penalty notices. Administrative fines can reach KES 5 million or 1% of the organisation's annual turnover in the preceding financial year, whichever is lower. The ODPC has issued penalties against digital lenders, schools, hospitality businesses and device makers, often for unlawful use of images, debt-shaming of borrowers' contacts and unsolicited marketing. The Commissioner can also order compensation to affected data subjects.

The Act also creates criminal offences, such as unlawfully disclosing personal data. A general penalty of a fine of up to KES 3 million, imprisonment of up to ten years, or both, applies to offences for which no specific penalty is provided. Directors and officers may be personally liable.

Data protection compliance checklist

Map the personal data you hold, where it comes from, why you hold it and who you share it with.
Register with the ODPC if you meet the thresholds or operate in a listed sector.
Publish a clear privacy notice and review your consent forms.
Put written agreements in place with all data processors and vendors.
Conduct DPIAs for high-risk processing.
Implement a breach response plan that meets the 72-hour deadline.
Set retention periods and securely delete data you no longer need.
Establish a process to respond to data subject requests.
Train staff, especially those handling customer and employee data.

Frequently asked questions

Does the Data Protection Act apply to small businesses?

Yes. All organisations must comply with the data protection principles, even if they are below the mandatory registration threshold. Small businesses in listed sectors such as healthcare and education must also register.

Can a lender contact a borrower's friends and family to recover a debt?

Accessing a borrower's phone contacts and contacting them to shame the borrower has been found by the ODPC to breach the Act, and digital credit providers have been penalised for it.

How long does an organisation have to respond to an access request?

The Data Protection (General) Regulations, 2021 require requests to be handled within the prescribed time, generally within seven days for access requests and fourteen days for correction and deletion requests.

How W.O.A. Advocates can help

We help organisations register with the ODPC, prepare privacy notices and policies, conduct DPIAs, respond to breaches and defend complaints. Talk to our data protection team, and see our article on AI regulation in Kenya.