Closing a data centre, whether by choice, at the end of a lease, or because a facility has reached the end of its useful life, is not simply a matter of switching off the power. Three separate obligations run in parallel: destroying or transferring the data still sitting on your equipment, winding down the regulatory licences the facility operates under, and disposing of the physical hardware itself, which Kenyan environmental law treats as hazardous waste, not ordinary rubbish.
Your customers’ data does not become yours to dispose of however you like
Where your facility processes personal data on behalf of customers, you are very likely acting as a data processor under the Data Protection Act, 2019, and the Act’s security obligations do not end simply because a contract is ending. Data still needs to be handled in line with whatever the underlying customer contract specifies for exit, typically return of the data to the customer, secure destruction, or both, and the decision should be documented, not left to whoever happens to be decommissioning the rack. A facility that simply wipes drives without following the contractually agreed exit process risks a breach of contract claim entirely separate from any data protection exposure.
Customer transition is a contract question you should have answered years earlier
A well-drafted colocation agreement specifies notice periods for termination, a defined exit assistance period during which the customer can migrate their equipment and data, and what happens to abandoned equipment if a customer simply disappears. If your agreements were not drafted with this level of specificity, decommissioning becomes a negotiation conducted under time pressure with every customer individually, rather than the execution of terms already agreed. This is exactly the gap a properly drafted operator-side colocation agreement is meant to close well before an exit is ever on the table.
Winding down the licences, not just the building
A facility’s Communications Authority network facilities licence and its NEMA environmental licence do not simply lapse quietly when a building goes dark. NEMA charges a specific fee, currently KES 5,000, for the surrender, transfer or variation of an environmental licence, meaning a formal surrender process exists and should actually be used rather than assumed. Failing to formally close out these licences can leave a facility technically still authorised, and still subject to whatever ongoing compliance and reporting obligations attach to that authorisation, long after the last customer has moved out.
The hardware itself is hazardous waste, not scrap
Kenya does not yet have a dedicated, binding electronic waste regulation in force, a specific e-waste regulation has been in draft before the National Environment Management Authority for some time and is not yet finalised. That gap does not leave decommissioned servers, switches and cooling equipment unregulated in the meantime. Electronic waste is treated as hazardous waste under the general provisions of the Environmental Management and Co-ordination Act, and NEMA’s own published e-waste guidelines, while not binding regulation in themselves, describe the handling, transport and disposal practice NEMA actually expects and will hold an operator to on inspection. Handling or transporting this equipment without a NEMA-licensed waste handler is a compliance gap worth closing now, not something to wait on the pending regulation to formalise.
Building the decommissioning plan before you need it
A workable decommissioning plan covers, at minimum, the specific data destruction or return standard you will apply and how you will document that it was actually followed, a defined customer notice and migration window drawn from your existing contracts rather than improvised at closure, formal surrender of your NEMA and Communications Authority licences rather than simply letting the facility go quiet, and an engagement with a NEMA-licensed e-waste handler for the physical equipment. None of this is complicated in isolation, but doing it under the pressure of an actual closure, rather than against a plan drafted while the facility was still operating normally, is where most of the real risk sits.
