Decommissioning a Data Centre in Kenya: Data Destruction and Customer Transition Obligations

Data centre decommissioning in Kenya raises three obligations that run in parallel: dealing with the customer data still on your equipment, closing out the permits and licences the facility holds, and disposing of the hardware lawfully. Each has a statutory source. The hardware obligation is now stricter than many operators assume, because Kenya has binding producer-responsibility rules covering electrical and electronic equipment. This article sets out what the statutes say and where the practical exposure sits.

Customer data does not become yours to dispose of

Where the facility hosts customers’ personal data, you are very likely a data processor under the Data Protection Act, 2019 (the DPA), meaning you process data on behalf of the customer as controller. Your duties do not end because a contract is ending.

Section 39(1) of the DPA allows a controller or processor to retain personal data only as long as is reasonably necessary for the purpose it was processed for, unless retention is required or authorised by law, reasonably necessary for a lawful purpose, or authorised or consented to by the data subject. Under section 39(2), data that is not necessary to retain must be deleted, erased, anonymised or pseudonymised at the end of the retention period. Section 41 separately requires appropriate technical and organisational measures that build the data protection principles into the processing.

In a data centre decommissioning, the contract with each customer decides whether the data is returned, destroyed or both. Get the customer’s written instruction before you wipe or remove anything, record what was done to which media and when, and keep that record. The DPA does not prescribe a destruction certificate, but a dated record is the practical way to show that section 39(2) was followed. Wiping drives without following the agreed exit process also risks a breach of contract claim that is separate from any data protection exposure.

Customer transition is a contract question

None of the statutes reviewed for this article prescribes an exit period for colocation customers, so the customer agreement governs. A well-drafted agreement sets notice periods for termination, a defined exit assistance period in which the customer can migrate its equipment and data, and a rule for equipment that a customer abandons. If your agreements are silent on these points, decommissioning becomes an individual negotiation with every customer under time pressure, rather than the execution of terms already agreed.

Review the agreements before you announce a closure, checking termination rights, service credits a shutdown could trigger, who bears the cost of removing customer equipment, and what happens to backups. If the facility is closing because it is being sold, the transaction documents will also allocate these liabilities; see our article on selling a data centre to private equity and our comparison of data centre exit routes.

Closing out licences and permits

A facility’s licences do not lapse simply because the building goes dark. Three sources are worth checking against your own file.

First, any licence from the Communications Authority of Kenya. Its conditions govern what must be notified or surrendered on closure, and where the business is being transferred rather than closed, the Kenya Information and Communications (Licensing) Regulations require notice or consent for transfers and changes in shareholding. Read the licence itself and write to the Authority before the last customer leaves.

Second, any environmental licence held under the Environmental Management and Co-ordination Act (EMCA). Section 65 deals with transfer of an environmental impact assessment licence by its holder to another person, by joint notice. We could not verify a fee schedule for surrender or variation from the statute itself, so check the current NEMA charges rather than relying on a figure quoted elsewhere.

Third, a waste licence. Section 88(1) of EMCA requires a person intending to generate hazardous waste to apply to NEMA for a licence before doing so. A decommissioning project generates a concentrated burst of such waste, including batteries and electronic equipment. Confirm whether your existing licences cover it, and apply early if they do not.

Failing to close out an authorisation formally can leave the facility technically licensed, and subject to reporting duties, long after operations have stopped.

Retired hardware is regulated waste, not scrap

Section 87 of EMCA prohibits discharging or disposing of waste in a way that causes pollution or ill health. It also bars anyone from transporting waste except under a valid NEMA transport licence and to a disposal site licensed by NEMA, and from operating a waste disposal site or plant without a licence. A contravention is an offence carrying imprisonment of up to two years, a fine of up to KES 1,000,000, or both. Section 12(4) of the Sustainable Waste Management Act, 2022 confirms that hazardous waste is managed as prescribed by EMCA, and section 20 requires a person who generates waste to dispose of it only to licensed waste service providers or designated collection points.

An outdated view in circulation says Kenya has no binding electronic waste rules and that a draft is pending. That is no longer accurate. The Sustainable Waste Management (Extended Producer Responsibility) Regulations, published as Legal Notice 176 of 2024 and since amended, apply to producers and to the products in their First Schedule, which includes electrical and electronic equipment, batteries and accumulators. They require producers to run take-back schemes, to set up or join an extended producer responsibility compliance scheme, and to register with the Authority. Whether a particular party is a producer depends on the Regulations’ definition and its place in the supply chain. For most operators the practical point is to route retired servers, switchgear and batteries through licensed collectors and the take-back channels producers are now obliged to run.

The order of operations matters. Sanitise or destroy data on every storage device first, using a documented method, and only then release the hardware to a licensed handler. Keep the handler’s licence details and its collection records with your decommissioning file.

A workable data centre decommissioning sequence

In practice the order is: map every customer, contract and data store; give notice and agree exit assistance; obtain written instructions on data; deal with the licensing authorities; sanitise media and record it; then engage licensed waste handlers. In any data centre decommissioning, disposing of equipment before the data and licences are dealt with is the common error.