A colocation agreement protects the operator when it is built deliberately around the operator’s own risk position, not assembled from accumulated customer concessions. Most start as a customer’s redlines against the first template the operator sent out, so the operator’s protections end up defined reactively, clause by clause. This article sets out the clauses that matter most: the liability cap, customer insurance, the data protection role, exit terms and audit rights. Kenyan statute says little directly about colocation, so most of this is contract design, with the Data Protection Act, 2019 (the DPA) supplying the legal frame for the data clauses.
Size the colocation agreement liability cap to what you can insure
A cap set as a multiple of monthly fees is common in a colocation agreement, but it should be set with your actual insurance programme in mind, not chosen arbitrarily and hoped to be defensible later. A cap your insurer will not indemnify is not a real protection. It is a promise you cannot necessarily keep. Compare the cap against the limits and exclusions of your property, business interruption, cyber and liability policies, and align them. Our article on insurance for a Kenyan data centre operator explains how to size that cover.
Carve-outs are unavoidable. Customers will reasonably expect your own gross negligence and wilful default to sit outside the cap. Draft those carve-outs narrowly and specifically so that they cannot be read to swallow the cap in an ordinary service dispute. Be equally careful with service credits: state whether they are the customer’s sole remedy for an outage, and whether they count toward the cap.
Require the customer to insure its own equipment
Your property insurance covers your building and your infrastructure. Do not assume it covers a customer’s servers sitting in your racks. A colocation agreement should expressly require the customer to insure its own equipment and, ideally, to name you as an additional interested party or waive subrogation against you, so that an insurer does not later pursue you for a loss the customer’s own policy was meant to cover.
Silence on this point is not neutral. It defaults to an argument about whose insurance should have responded, conducted after the loss instead of settled in advance. Add a clause requiring the customer to provide evidence of cover on request, and to keep it in force for as long as its equipment is on site.
Scope your data protection role precisely
Where a customer processes personal data on equipment in your facility, you are very likely a data processor, and sometimes a sub-processor, not a controller. Section 42(2) of the DPA says that where a controller uses a processor, the two must enter into a written contract under which the processor acts only on the controller’s instructions, and the controller must choose a processor that gives sufficient guarantees about organisational measures for complying with section 41(1). Your colocation agreement is the natural place for that written contract, or it should point to one.
Resist language that describes your role more broadly than you actually control. A clause that casts you as jointly responsible for the customer’s own processing decisions can expose you to liability for choices you had no part in making. Section 41 still places a duty on processors as well as controllers to implement appropriate technical and organisational measures, so describe the security measures you do provide, and no more.
Be equally precise about breach notification. Under section 43(3) of the DPA, a data processor that becomes aware of a personal data breach must notify the data controller without delay and, where reasonably practicable, within forty-eight hours. The duty to notify the Data Commissioner within seventy-two hours falls on the controller under section 43(1). Write your clause around the processor duty: you notify the customer promptly of an incident affecting its equipment or data, and the customer decides whether and how to notify the regulator. The agreement should fix an incident contact on both sides so that the forty-eight hour window can be met in practice.
Build exit terms that do not leave you holding abandoned equipment
A defined exit process in the colocation agreement protects you as much as the customer. Provide for a fixed notice period, a defined window for the customer to remove its equipment, and a right to charge storage fees. Where a customer disappears or disputes a final invoice, there should be a clear route to dispose of equipment, consistent with your data destruction obligations. Without it, an operator can end up holding a former customer’s servers indefinitely, unable to reclaim rack space and unable to dispose of equipment that may still hold the customer’s data.
Section 39 of the DPA limits retention of personal data to what is reasonably necessary for the purpose and requires deletion, erasure, anonymisation or pseudonymisation of data that need not be retained. The exit clause should therefore state who instructs deletion, what proof is given, and how long you will keep media before disposal. Our article on decommissioning a data centre in Kenya covers data destruction and customer transition in more detail.
Keep audit and access rights proportionate
Enterprise customers, particularly regulated ones, will often want audit rights over your security and compliance posture. These are reasonable in principle but need boundaries in the colocation agreement: reasonable notice, a capped frequency, confidentiality over what an audit reveals about your other customers, and a mechanism to satisfy the request through an independent certification or report instead of an open-ended physical inspection.
Treat physical access the same way. Specify who may enter the facility, under escort, with what identification, and how access is logged. Those records also support your position if a customer later alleges tampering or loss. A clear access clause reduces both operational risk and the scope for disputes.
How We Can Help
Clay & Associates Advocates can review your standard colocation agreement against your insurance and your data protection position, and advise on the negotiation of customer redlines. See our regulatory compliance practice or contact us to discuss your agreement.
Frequently asked questions
Is a colocation operator a data processor?
Where customers process personal data on equipment in your facility, you are very likely a processor, and section 42(2) of the DPA requires a written contract with the controller.
Who must tell the Data Commissioner about a breach?
The controller, within seventy-two hours (section 43(1)). A processor must notify the controller without delay and, where reasonably practicable, within forty-eight hours (section 43(3)).
Should the customer insure its own servers?
Yes, the agreement should require it, together with evidence of cover, so that disputes over whose insurance responds do not arise after a loss.
How should a colocation agreement deal with abandoned equipment?
Provide for notice, a removal window, storage fees and a right to dispose of equipment after data has been dealt with in line with the agreement and section 39 of the DPA.
