Data monetization and commercial use of personal data is a live legal question for any company holding a large dataset of Kenyan customers. Transaction histories, location data and browsing behaviour cannot simply be sold or licensed for profit. Kenya’s Data Protection Act, 2019 treats commercial use of personal data as a restricted activity requiring a specific legal basis, not something that follows automatically from having lawfully collected the data. For fintech, telco, retail and adtech businesses sitting on valuable datasets, knowing exactly where that line sits is a commercial question, not an abstract compliance exercise.
The Core Restriction
Mobile money transaction histories, telecom usage patterns, loyalty programme data and location data from ride-hailing or delivery apps all have obvious secondary commercial value, often well beyond the purpose for which the data was collected. It is precisely that gap between original purpose and secondary use that section 37 targets.
Section 37 of the Data Protection Act, 2019 prohibits using personal data for commercial purposes unless the person has sought and obtained express consent from the data subject, or is authorised to do so under written law and the data subject was informed of that use when the data was collected. A controller or processor using personal data for commercial purposes must, where possible, anonymise it so the data subject is no longer identifiable. The Cabinet Secretary, in consultation with the Data Commissioner, may prescribe practice guidelines on commercial use.
Section 37 itself does not set a penalty. A contravention of the Act for which no specific penalty is provided attracts the general penalty in section 73: on conviction, a fine not exceeding three million shillings or imprisonment not exceeding ten years, or both.
What Counts as Commercial Use
The Data Protection (General) Regulations, 2021 (Legal Notice 263 of 2021) give the restriction operational detail in the part on commercial use of personal data. A controller or processor uses personal data to advance commercial interests where it is used for direct marketing, for example by sending a catalogue addressed to a data subject, displaying an advertisement to a logged-in data subject using their personal data, or sending an electronic message about a sale using personal data the data subject provided. Marketing is not direct where personal data is not used or disclosed to identify or target particular recipients. The test is broad, so targeted advertising and data-driven lead generation can fall within it, not just an outright sale of a dataset.
Regulation 15 permits direct marketing using personal data, other than sensitive personal data, only where the data was collected from the data subject, the data subject was notified that direct marketing is one of the purposes, the data subject has consented, and a simplified opt-out mechanism is provided and has not been used. The Regulations also prohibit profiling of a child that relates to direct marketing. Sensitive categories such as health, biometric and genetic data are therefore outside this permitted route.
Notice, Opt-Out and a Separate, Lighter Penalty
Marketing messages must indicate particulars to which a data subject can send a request to restrict such communications without charge. Under regulation 16 an opt-out mechanism must have a visible, clear and easily understood explanation and a process that requires minimal time and effort, so a buried unsubscribe link or a multi-step opt-out would likely fail the standard.
The Regulations also attach a separate penalty to non-compliant direct marketing: on conviction, a fine not exceeding twenty thousand shillings or imprisonment not exceeding six months, or both. That sits beside the Act’s heavier general penalty. A marketing-specific failure may fall under the lighter track, but broader unauthorised commercial exploitation of personal data sits under the Act, and companies should not assume the lighter figure caps their exposure.
Data Localisation and Cross-Border Monetisation
A business model built on licensing Kenyan user data to an offshore analytics or advertising partner meets a second constraint: the cross-border transfer rules. Section 48 of the Act allows transfer out of Kenya only where, among other routes, the controller or processor has given the Data Commissioner proof of appropriate safeguards, including jurisdictions with commensurate data protection laws, or the transfer is necessary for one of the purposes listed in the section.
Separately, regulation 26 requires processing for specified purposes of strategic interest to the State, such as civil registration and legal identity systems and the conduct of elections, to be done through a server and data centre in Kenya, or at least one serving copy of the data to be stored in a Kenyan data centre. Check the full list in regulation 26 before assuming a dataset is outside it.
Practical Implication for a Data Monetisation Strategy
A viable data monetisation model in Kenya generally rests on one of two foundations. The first is genuine anonymisation, robust enough that data subjects are no longer identifiable, which takes the data outside the personal data regime. The second is a properly structured consent and notice architecture that satisfies both the Act and the Regulations’ notice and opt-out mechanics. Relying on a blanket terms-of-service clause obtained at signup, without the specific commercial-use disclosure the Act requires at collection, is a common but fragile basis for a monetisation programme.
Complaints and Enforcement
A data subject who believes their personal data has been used commercially without a proper basis can complain to the Data Commissioner, who may investigate and issue enforcement notices. The Data Commissioner also keeps a register of registered data controllers and processors under section 21 of the Act. Digital credit providers and digital health platforms are bound by these restrictions on top of their sector rules, so a monetisation strategy layered onto a regulated product must satisfy both regimes. See our guides to digital credit provider licensing and digital health and telemedicine regulation, and our overview of the Data Protection Act 2019.
How We Can Help
Clay & Associates Advocates advises on data protection compliance architecture, consent frameworks, anonymisation strategy and cross-border data transfer structuring for businesses building data monetisation, targeted advertising or data licensing products. Our regulatory and compliance practice can assess your data strategy; please contact us to discuss it.
Sources: Data Protection Act, 2019 (No. 24 of 2019), sections 21, 37, 48 and 73, Kenya Law; Data Protection (General) Regulations, 2021 (Legal Notice 263 of 2021), Kenya Law.
Frequently asked questions
Can a company sell personal data it has lawfully collected?
Only with the data subject’s express consent, or where written law authorises it and the data subject was told of the use at collection (section 37).
Does anonymising data remove the restriction?
Data that no longer identifies a data subject falls outside the personal data regime, and the Act requires anonymisation where possible when personal data is used commercially.
What are the penalties for breaching the commercial-use restriction?
The general penalty in section 73 is a fine of up to three million shillings, imprisonment of up to ten years, or both. Non-compliant direct marketing under the Regulations carries up to twenty thousand shillings or six months.
Can personal data be sent offshore for analytics or advertising?
Only if a section 48 route is satisfied, and certain strategic processing must be done in or kept in Kenya under regulation 26.
Need advice on your own matter?
Tell us what you are dealing with. You will know what it involves and what it costs before you commit.
This article is general information on Kenyan law as at its publication date, not legal advice. Reading it does not create an advocate and client relationship.
