Kenya Data Protection Act — Data Protection Act, 2019
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentActSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionAfricaRegion DetailKenyaPublisherParliament of Kenya
- VersioningVersionData Protection Act, No. 24 of 2019 (Cap. 411C), revised edition as at December 31, 2022Effective DateNovember 25, 2019Issue DateNovember 8, 2019 (assent); published in the Kenya Gazette November 15, 2019
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Act is published free by the Office of the Data Protection Commissioner and on Kenya Law, where legislation carries no copyright; the platform links to the official text.
Framework text is licensed by its publisher and is included only where stated above.
- Kenya's Data Protection Act, 2019 regulates personal data processing by controllers and processors in Kenya and those abroad processing data of people in Kenya.
- Assented November 8, 2019, it commenced on November 25, 2019 and gives effect to Article 31 of the Constitution of Kenya.
- It establishes the Office of the Data Protection Commissioner, which registers controllers and processors, receives breach notices, and imposes penalties.
- Controllers and processors must register unless exempt, notify qualifying breaches within 72 hours, and run impact assessments before high-risk processing.
- Three sets of 2021 regulations cover general rules, complaints handling and enforcement, and registration.
Overview
The Data Protection Act, 2019 (Act No. 24 of 2019, Cap. 411C) is Kenya's data protection statute. It regulates the processing of personal data by any data controller or data processor established or ordinarily resident in Kenya, and by those outside Kenya who process the personal data of data subjects located in Kenya (section 4). Parliament passed it, the President assented on November 8, 2019, the Kenya Gazette published it on November 15, 2019, and it commenced on November 25, 2019.
The Act gives effect to Article 31(c) and (d) of the Constitution of Kenya, which protect privacy. Section 3 sets five objects: to regulate processing, to guide it by the principles in section 25, to protect privacy, to create the legal and institutional mechanism for protection, and to give data subjects rights and remedies. Section 5 establishes the Office of the Data Protection Commissioner (ODPC), headed by the Data Commissioner, which registers controllers and processors, receives breach notices, investigates complaints and imposes penalties.
The Act works with three sets of regulations made in 2021: the Data Protection (General) Regulations (Legal Notice 263), the Complaints Handling Procedure and Enforcement Regulations (Legal Notice 264) and the Registration of Data Controllers and Data Processors Regulations (Legal Notice 265).
Why does it matter?
The Act applies to every sector, so a bank, a hospital, a school, a telecom and a ride-hailing app all answer to the same Commissioner. Controllers and processors must register with the ODPC unless exempt (section 18), notify the Commissioner of a qualifying breach within 72 hours (section 43), and run a data protection impact assessment before high-risk processing (section 31). An administrative fine can reach KES 5 million or 1 percent of the preceding year's turnover, whichever is lower (section 63), and unlawful disclosure and selling of personal data are criminal offences (section 72).
Key benefits include:
- A registered, public list of data handlers
Section 18 requires registration with the Data Commissioner, and section 21 makes the register a public document. A certificate is valid for 24 months under regulation 9 of the Registration Regulations.
- Eight principles that bind processors too
Section 25 applies to every controller and processor, including lawful, fair and transparent processing, purpose limitation, data minimization, accuracy and storage limitation.
- A 72-hour breach clock
Section 43(1) requires notice to the Commissioner within 72 hours of becoming aware of a breach with a real risk of harm; a processor tells the controller within 48 hours where practicable.
- Rights with deadlines
The General Regulations require a data access request to be met within seven days (regulation 9) and data portability within 30 days (regulation 11).
- Transfers under Commissioner control
Sections 48 and 49 allow transfers out of Kenya only with proof of safeguards, and sensitive personal data only with consent and safeguards.
How does it work?
Section 18 requires registration, and section 19 sets the particulars: the data processed, the purpose, the data subject categories and the security measures. Regulation 13 of the Registration Regulations exempts an entity with annual turnover or revenue below KES 5 million and fewer than ten employees, but the Third Schedule requires registration whatever the size for purposes such as financial services, health, education, direct marketing, gambling, telecommunications and processing genetic data. The exempt entity must still comply with Parts IV and VI.
Part IV sets the working obligations. Section 28 requires collection from the data subject, section 29 requires notice before collection, and section 30 lists the lawful bases, including consent, contract, legal obligation, vital interests and legitimate interests. Section 32 puts the burden of proving consent on the controller. Section 41 requires data protection by design and by default, and section 42 requires a written contract with each processor that acts only on the controller's instructions. Part V covers sensitive personal data, and the Commissioner enforces through audits (section 23), enforcement notices (section 58) and penalty notices (section 62).
Key Elements
- Data protection principles (section 25)
Eight principles: privacy rights, lawfulness, fairness and transparency, specified purposes, minimization, accuracy, limited storage, and no transfer outside Kenya without safeguards or consent.
- Data subject rights (sections 26, 34 to 40)
To be informed, to access, to object, to correct and delete false data, to restrict processing, to portability, and not to be subject to solely automated decisions (section 35).
- Lawful processing and consent (sections 30 and 32)
Consent for specified purposes or one of the listed grounds, with the controller carrying the burden of proof and the right to withdraw consent at any time.
- Data protection impact assessment (section 31)
Required before high-risk processing; regulation 49 lists triggers such as biometric or genetic data, children's data, large-scale processing and automated decisions.
- Data protection officer (section 24)
A controller or processor may designate one, notably where core activities involve regular and systematic monitoring or sensitive categories; contact details are published and given to the Commissioner.
- Breach notification (section 43)
Notice to the Commissioner in 72 hours and to affected data subjects without undue delay, unless encryption or similar safeguards were applied (section 43(6)).
What does it cover?
The Act applies to personal data recorded by automated or non-automated means, if it forms part of a filing system (section 4(a)). It reaches controllers and processors established or ordinarily resident in Kenya and those outside Kenya that process the personal data of data subjects located in Kenya (section 4(b)). Sensitive personal data includes race, health status, ethnic social origin, belief, genetic and biometric data, property details, marital status, family details and sex or sexual orientation (section 2). Parts V and VI add rules for sensitive data and for transfers outside Kenya, and Part VII sets exemptions for journalism, research and the Commissioner's own exemptions (sections 52 to 54).
What are its objectives?
The Act sets out its aims in section 3 and gives the ODPC the tools to achieve them.
Regulate the processing of personal data under the principles in section 25.
Protect the privacy of individuals as the Constitution guarantees.
Establish the Office of the Data Protection Commissioner and the register of controllers and processors.
Give data subjects rights and remedies, including complaints decided within 90 days (section 56(5)) and compensation for damage (section 65).
Deter breaches through administrative fines (section 63) and offences (sections 72 and 73).
Framework in Context
Like the EU GDPR, the Act uses controller and processor roles, a list of lawful bases, impact assessments and a 72-hour breach notice. It adds a public registration regime (section 18), a 90-day complaint deadline (section 56(5)) and a power for the Cabinet Secretary to require some processing to take place on a server or data center in Kenya (section 50). Cross-border transfers are further addressed in Part VII of the General Regulations and in the ODPC's published guidance note on cross-border data transfers.
Common Framework Mappings
Organizations map the Act to the privacy frameworks below so that one set of records, assessments and controls serves the ODPC and other regulators.
Mapped frameworks include:
APEC PF
CCPA/CPRA
GDPR
ISO 27701
NIST Privacy Framework v1.0
OECD Privacy Guidelines
POPIA
UK DPA 2018
How SmartSuite Supports the Kenya Data Protection Act
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management to hold the personal data inventory, privacy assessments and data subject requests the Act requires, with Compliance Management linking each section to its policy and evidence and Third Party Risk Management tracking processors and their written contracts.
Register Records for ODPC Registration
Hold each controller and processor entity with its section 19 particulars, certificate number, 24-month expiry and renewal date.
Personal Data Inventory
Record data categories, purposes, lawful bases under section 30, sensitive data flags and retention periods in Privacy Management.
Data Subject Request Tracking
Log access, rectification, erasure, objection and portability requests with the seven-day and 30-day deadlines from the General Regulations.
Data Protection Impact Assessments
Run section 31 assessments with the regulation 49 triggers, approvals and the outcome of any consultation with the Commissioner.
Breach Register and 72-Hour Clock
Record each breach with discovery time, risk-of-harm assessment, ODPC notice and data subject communication under section 43.
Processor and Transfer Oversight
Track section 42 processor contracts, safeguards for section 48 and 49 transfers and monitoring of each processor.
Related frameworks
The APEC Privacy Framework (2015) sets nine information privacy principles that APEC economies use to protect personal information while keeping data flowing across the region.
The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out, and is enforced by the California Privacy Protection Agency.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
The NIST Privacy Framework Version 1.0 is a voluntary tool for managing privacy risk: five Functions, 18 Categories, 100 Subcategories, Profiles and four Implementation Tiers.
Frequently Asked Questions For Kenya Data Protection Act (Data Protection Act, 2019)
Section 4 applies the Act to controllers and processors that are established or ordinarily resident in Kenya and process personal data there, and to those not established in Kenya that process the personal data of data subjects located in Kenya. It covers automated processing and non-automated processing of a filing system, in the public and private sectors.
Section 18 says no one may act as a controller or processor unless registered, subject to thresholds. Regulation 13 of the Registration Regulations exempts entities with annual turnover or revenue below KES 5 million and fewer than ten employees, but the Third Schedule requires registration for purposes such as financial services, health, education, telecommunications, direct marketing and processing genetic data.
Section 43(1) requires a controller to notify the Data Commissioner within 72 hours of becoming aware of a breach that gives a real risk of harm, with reasons if it is late (section 43(2)). A processor must tell the controller without delay and, where practicable, within 48 hours (section 43(3)). Affected data subjects are told in writing within a reasonably practical period unless encryption or similar safeguards were applied.
The Commissioner can issue a penalty notice of up to KES 5 million or, for an undertaking, 1 percent of the preceding year's turnover, whichever is lower (sections 62 and 63). Offences such as unlawful disclosure (section 72) and the general penalty in section 73 carry a fine of up to KES 3 million, imprisonment of up to ten years, or both. A data subject can also claim compensation (section 65).
Section 24 allows a controller or processor to designate a data protection officer, notably where core activities involve regular and systematic monitoring or sensitive data; contact details must be published. Section 31 requires a data protection impact assessment before processing likely to create high risk, and regulation 49 of the General Regulations lists triggers such as biometric data, children's data and large-scale processing.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.