Meet Kenya DPA obligations without rebuilding your privacy programme

The Kenya Data Protection Act 2019 (Act No. 24 of 2019) is Kenya's main data protection law. It commenced on 25 November 2019, gives effect to the constitutional right to privacy, and created the Office of the Data Protection Commissioner. It sets data protection principles, data subject rights, registration duties for controllers and processors, security and breach notification obligations, and conditions for transferring personal data out of Kenya.

Data controllers and data processors established or ordinarily resident in Kenya must comply, as must those outside Kenya that process personal data of data subjects located in Kenya. This means foreign companies, including UK businesses, serving Kenyan customers or employing staff in Kenya can fall within scope. Section 18 also requires controllers and processors to register with the Data Commissioner, subject to thresholds the Commissioner prescribes.

Under section 63, the Data Commissioner can impose an administrative fine of up to five million Kenyan shillings or, for an undertaking, up to one per cent of its annual turnover for the preceding financial year, whichever is lower. Separately, section 73 sets a general criminal penalty of a fine up to three million shillings, imprisonment of up to ten years, or both. Data subjects can also claim compensation under section 65.

A data controller must notify the Data Commissioner without delay and within 72 hours of becoming aware of a breach where there is a real risk of harm, under section 43. A late notification must give reasons for the delay. Affected data subjects must be told in writing within a reasonably practical period, and processors must notify the controller without delay, where practicable within 48 hours.

The Kenya DPA is closely modelled on the GDPR. Both set similar principles, lawful bases, data subject rights, data protection impact assessments, privacy by design, a 72-hour breach notification window and transfer restrictions. Key differences include the Kenyan requirement to register with the Data Commissioner, its own fine levels and the Cabinet Secretary's power to require some processing through servers or data centres in Kenya. GDPR controls give a strong head start.

Compliance starts with checking whether you must register with the Data Commissioner, then mapping your processing, confirming a lawful basis for each activity and updating privacy notices. You should appoint a Data Protection Officer where required, run impact assessments for high-risk processing, implement security measures, set retention periods, prepare a breach response process and put safeguards in place for transfers out of Kenya.

Yes, partly. The Act requires appropriate technical and organisational measures to protect personal data, including data protection by design and default under sections 41 and 42. An ISO 27001 information security management system provides strong evidence for those security obligations, but it does not cover the Act's privacy duties such as registration, consent, data subject rights and transfer conditions, which need separate controls.

The Kenya Data Protection Act is mapped in OneClickComply's control library and available on request. Customers can reuse controls and evidence from GDPR or ISO 27001 against the Act's sections, collect security evidence automatically, generate policies and monitor controls continuously. OneClickComply does not register you with the Data Commissioner or guarantee compliance, but our audit team can advise on gaps.