Insurance a Kenyan Data Centre Operator Actually Needs

Data centre insurance in Kenya is mostly a commercial decision, not a compliance checklist. The one cover the statutes make mandatory for an operator’s own staff is work injury insurance under the Work Injury Benefits Act, 2007. Everything else, from property and equipment cover to business interruption and cyber insurance, should be sized against what your customer contracts promise and what a single incident would cost. This article explains the mandatory cover first, then how to size the rest.

The one cover the law requires

Section 7(1) of the Work Injury Benefits Act, 2007 requires every employer to obtain and maintain an insurance policy, with an insurer approved by the Cabinet Secretary, for any liability the employer may incur under the Act to its employees. A data centre’s physical operations carry real injury risk for the technical staff who maintain them: high-voltage electrical systems, backup generators, fuel storage and cooling plant.

The Cabinet Secretary may exempt an employer who maintains an approved security, meaning an undertaking by an approved surety to make good any failure by the employer to discharge its liability (section 7(2) and (3)). Absent an exemption, an employer that does not insure commits an offence liable to a fine of up to KES 100,000, imprisonment for up to three months, or both. If the contravention continues after conviction, it is a further offence with a fine of up to KES 10,000 for each day it continues (section 7(4) and (5)). Without cover, the employer would also bear the full cost of a workplace injury claim directly.

Data centre insurance for property and equipment

No statute we reviewed prescribes property cover for a data centre, so the question is purely one of exposure and data centre insurance should be sized to it. Standard commercial property insurance often reflects the building’s construction cost, not the replacement cost of its contents. Servers, UPS systems, precision cooling plant and switchgear are specialised, frequently imported equipment with long lead times, and a policy sized against the shell will leave a gap exactly when it is tested.

Confirm in writing that the policy covers electrical and mechanical breakdown as well as fire and physical damage. A cooling failure or switchgear fault is a more likely loss event for this kind of facility than a fire. Check also whose equipment is covered. Customer-owned equipment racked in your facility may not be yours to insure, so the colocation agreement should say who insures it and who bears the loss if it is damaged. For the wider contract position, see our article on decommissioning a data centre in Kenya, which covers exit terms.

Business interruption cover tied to your contracts

If your colocation agreements commit to uptime service levels, an outage is more than a repair bill. It is lost revenue plus the service credits your own contracts oblige you to pay. Size business interruption cover against that real exposure rather than a generic indemnity period that ignores how your customer agreements are structured.

Read the policy’s waiting period, its indemnity period and its definition of insured peril alongside the service-level schedules. A policy that responds only after a long waiting period may not help with contracts that trigger credits after minutes of downtime. Also check whether dependency on utilities is covered, because a grid or fibre failure outside your premises can halt service without any damage on site.

Cyber insurance responds to a different loss than property cover

A data breach or ransomware incident affecting customer systems hosted at your facility is not a property loss, and a standard commercial policy typically will not respond to it. A dedicated cyber policy, bought alongside your other data centre insurance, should address incident response costs, the cost of meeting your notification obligations, and third-party liability where a security failure at your facility causes loss to a customer’s business.

Get the notification clock right when you price this cover. Under section 43(1) of the Data Protection Act, 2019, it is the data controller that must notify the Data Commissioner within seventy-two hours of becoming aware of a breach where there is a real risk of harm. Where a data processor becomes aware of a breach, section 43(3) requires it to notify the controller without delay and, where reasonably practicable, within forty-eight hours. A facility that hosts customers’ data is very likely a processor, so its own contractual and statutory clock is the shorter one.

Confirm the policy covers incidents originating in your physical infrastructure, not only in your corporate IT systems, and ask the insurer to state in writing whether regulatory penalties are covered. Our article on selling a data centre to private equity explains why a buyer’s diligence will probe these same incident-response arrangements.

Liability cover for visitors and directors

Public liability cover matters more for a facility that regularly hosts customer engineers, auditors and technicians on site than for an ordinary office, given the physical hazards a data floor presents to visitors unfamiliar with it. Where directors or senior managers face personal exposure for governance failures, cyber incidents or regulatory breaches, directors’ and officers’ cover is worth pricing separately instead of assuming it is folded into a general commercial package.

Building the programme around your contracts

The right data centre insurance programme is not a template. It follows from what your colocation agreements promise customers, what your equipment would cost to replace, and what a particular security incident would cost to respond to and notify. Review the insurance programme alongside the colocation agreements, not as two separate exercises, so that the limits in one match the liabilities in the other. In particular, compare each limit of liability and exclusion in your customer agreements against what your policies would actually pay, and fix the mismatch before a claim arises.