ODPC Enforcement in Kenya: How to Respond to an Investigation or Notice

ODPC enforcement Kenya businesses face begins when the Office of the Data Protection Commissioner receives a complaint, opens an investigation or decides that you have failed to comply with the Data Protection Act, 2019. The Act gives the Data Commissioner real powers: to summon witnesses and documents, to issue enforcement notices, to issue penalty notices and, with a court warrant, to enter and search premises. This guide explains each step, the penalties the Act actually sets and how to respond so that a notice does not become a prosecution or a larger fine.

How ODPC enforcement Kenya cases start

Most cases begin with a complaint. Section 56 of the Act allows a data subject who is aggrieved by a decision of any person under the Act to complain to the Data Commissioner, orally or in writing. If the complaint is oral, the Commissioner must record it in writing. Section 56(5) states that a complaint made to the Commissioner shall be investigated and concluded within ninety days. That timetable tells you something practical: when a complaint arrives, you will not have months to gather your thoughts.

The Data Commissioner can also act where a person has failed, or is failing, to comply with any provision of the Act, as section 58 puts it. A complaint is therefore not a precondition for action, although it is the most common trigger.

The Commissioner’s investigation powers

Under section 57, for the purpose of investigating a complaint, the Commissioner may order any person to attend at a specified time and place to be examined orally, and to produce books, documents, records or articles relevant to the investigation. Section 59 lets the Commissioner seek assistance from any person or authority reasonably necessary to carry out an investigation. Section 60 allows entry and search of premises, but only after obtaining a warrant from a court. Section 61 makes it an offence to obstruct the Commissioner in the exercise of these powers.

Treat every request for information seriously and answer it in the time given. Cooperation is also a factor in how penalties are assessed, as explained below.

ODPC enforcement Kenya notices

Section 58 allows the Commissioner, when satisfied that a person has failed or is failing to comply with the Act, to serve an enforcement notice requiring specified steps within a specified period. The notice must specify the provision that has been, is being or is likely to be contravened and the measures required to remedy the contravention. The period for compliance cannot be shorter than twenty-one days, and the notice must state any right of appeal.

Failure to comply with an enforcement notice without reasonable excuse is an offence. On conviction the penalty is a fine of up to five million shillings, imprisonment for up to two years, or both. Calendar the deadline the day the notice arrives, and if you cannot comply in time, write to the Commissioner before the date passes to explain why and what you propose.

ODPC enforcement Kenya penalties and fines

Section 62 allows the Commissioner to issue a penalty notice requiring payment of an amount specified in the notice where there has been a failure of the kind described in section 58. Section 63 sets the ceiling. The maximum penalty is up to five million shillings or, for an undertaking, up to one per cent of its annual turnover of the preceding financial year, whichever is lower, as the Act is worded.

When deciding whether to issue a penalty notice and how much to impose, the Commissioner must have regard to the factors listed in section 62(2). They include:

• the nature, gravity and duration of the failure;
• whether the failure was intentional or negligent;
• action taken to mitigate harm to data subjects;
• the degree of responsibility, taking into account technical and organisational measures;
• previous failures and compliance with earlier notices;
• the degree of cooperation with the Commissioner;
• how the infringement became known, including whether you reported it yourself; and
• adherence to approved codes of conduct or certification.

This list is your response plan. Each factor is something you can address with evidence: your security measures, your remedial steps, your cooperation and your prompt self-reporting.

Criminal liability

Separate from administrative fines, the Act creates offences. Section 73 provides that a person who commits an offence under the Act for which no specific penalty is provided, or who otherwise contravenes the Act, is liable on conviction to a fine not exceeding three million shillings, imprisonment for up to ten years, or both. The court may also order forfeiture of equipment or articles used in the offence. Section 72 deals separately with unlawful disclosure of personal data. These are matters for the courts, not the Commissioner, so they are a reason to take early legal advice when an investigation involves deliberate conduct.

Compensation claims by data subjects

Section 65 entitles a person who suffers damage because of a contravention of the Act to compensation from the data controller or the data processor. This exposure runs alongside any regulatory penalty. A complaint to the Commissioner and a claim for compensation are different processes, and a business should prepare for both when a significant incident occurs.

Appealing a decision

Section 64 allows a person against whom the Commissioner has taken administrative action, including an enforcement or penalty notice, to appeal to the High Court. Because the appeal route is a right granted by the Act and is stated in the notice itself, check the notice for any deadline before you decide how to respond. Our litigation and dispute resolution practice advises on contesting regulatory decisions.

A practical response checklist

• Record the date the notice or letter was received and the deadline it sets.
• Preserve the relevant records, and do not delete or alter data connected with the complaint.
• Appoint one person to coordinate your response and communicate with the Commissioner.
• Establish the facts quickly: what data, which individuals, what went wrong and when.
• Fix the problem and document the steps taken, because remedial action counts when penalties are assessed.
• Reply in writing within the time allowed, and ask for an extension in writing if you need one.
• Take advice before any admission, and before deciding whether to appeal.

A business that already has a documented compliance programme, with a register of processing, a privacy notice, security measures and an incident procedure, is far better placed to show the Commissioner it acted responsibly. Our regulatory compliance practice helps clients build that evidence before a complaint arrives.