The Data Protection Act 2019: What Every Kenyan Business Needs to Do

The Data Protection Act 2019 (Act No. 24 of 2019) applies to every business that collects, stores or uses personal data in or from Kenya, and the Office of the Data Protection Commissioner (ODPC) enforces it. Under section 63, the maximum administrative penalty is up to KES 5,000,000 or, in the case of an undertaking, up to one per cent of its annual turnover of the preceding financial year, whichever is lower. That is a more lenient formula than the GDPR’s “whichever is higher”, but for a large undertaking one per cent of turnover can still be substantial.

Data Protection Act 2019: What Counts as Personal Data

Personal data is any information relating to an identified or identifiable natural person: names, ID numbers, phone numbers, email addresses, location data, financial and employment records and similar information. Sensitive personal data, which includes categories such as health status, genetic and biometric data and sexual orientation, attracts additional protection and generally requires a stronger legal basis before processing.

Step 1: Register With the ODPC, If Required

Section 18 provides that no person shall act as a data controller or data processor unless registered with the Data Commissioner, who prescribes the mandatory registration thresholds. Under regulation 13 of the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, an entity is exempt only if it has annual turnover or revenue below five million shillings and fewer than ten employees. Even a small entity must still register if it processes personal data for a purpose listed in the Third Schedule, which includes gambling, operating an educational institution, health administration, hospitality, property management, provision of financial services, telecommunications, direct marketing, transport services, operating security CCTV and processing genetic data. Exempt entities must still comply with the Act’s substantive obligations.

Step 2: Conduct a Data Audit

A data audit maps what personal data you collect, where it is stored, who has access, how long it is kept and who it is shared with. Common findings are collecting more data than necessary or keeping it too long, contrary to the principles in section 25; sharing data with processors without adequate contractual safeguards; and using data beyond the purposes originally stated to the data subject. Audits also surface “shadow” processing, such as a marketing tool quietly collecting more fields than the business uses.

Step 3: Publish a Privacy Policy

A privacy policy should tell individuals who the controller is, what data is collected and why, the legal basis, who it is shared with, how long it is retained and how to exercise their rights. A foreign template never adapted to your actual practices is a common and easily identified gap. Section 29 sets out the controller’s duty to notify the data subject when collecting personal data.

Step 4: Establish a Lawful Basis for Processing

Section 30 prohibits processing unless the data subject consents or the processing is necessary for one of the listed purposes, including performing a contract, complying with a legal obligation, protecting vital interests, a public interest task or the legitimate interests of the controller or a third party, except where overridden by the data subject’s rights. Many businesses over-rely on consent, which can be withdrawn; contractual necessity or legitimate interest is often the more robust basis where it genuinely applies.

Step 5: Secure the Data

Section 41 requires data protection by design or by default: appropriate technical and organisational measures that implement the data protection principles and build safeguards into the processing. In practice this means encryption, access controls, backups, staff training and a documented breach response plan. Section 43 sets the timeline: where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the data subject, the controller must notify the Data Commissioner without delay, within seventy-two hours of becoming aware, with reasons if it is late. A processor must notify the controller without delay and, where practicable, within forty-eight hours. A breach plan that has been rehearsed is far more likely to meet these deadlines.

Step 6: Handle Data Subject Requests

Section 26 gives a data subject the right to be informed of the use of their data, to access it, to object to processing, and to correct or delete false or misleading data. The Act also provides for restriction of processing (section 34) and data portability (section 38). Build a documented process for receiving, verifying and answering requests, including checking that the requester is the data subject before disclosing anything.

Consequences of Non-Compliance

Beyond the administrative fines under section 63, a person who suffers damage from a contravention is entitled to compensation from the controller or processor under section 65. Any person against whom administrative action is taken by the Data Commissioner, including enforcement and penalty notices, may appeal to the High Court under section 64. Reputational damage from a publicised breach often exceeds the fine itself.