Understanding Kenya's New Data Protection Act

With the rapid digitization of the Kenyan economy, the Data Protection Act 2019 has become one of the most critical pieces of legislation for businesses. The Act, enforced by the Office of the Data Protection Commissioner (ODPC), imposes strict compliance requirements for handling personal data.

Who Does This Act Apply To?

It applies to any person or organization that processes personal data of individuals in Kenya, whether the entity is based in the country or not. This includes e-commerce platforms, SMEs, banks, healthcare providers, and even employers keeping employee records.

Key Compliance Requirements

• Registration: Data controllers and processors must register with the ODPC annually.
• Lawful Basis: You must have a valid legal basis (consent, contract, legal obligation) to process data.
• Data Subject Rights: Individuals have the right to access, correct, and delete their data.
• Cross-Border Transfers: Transferring data outside Kenya requires prior approval from the ODPC.

Implications for Business Owners

Failure to comply can lead to severe penalties, including fines of up to 5% of annual turnover or 20 million Kenyan Shillings. Beyond compliance, acting responsibly with data fosters immense customer trust, which is crucial for long-term success.

"Data protection is no longer just an IT issue. It is a critical legal, operational, and ethical obligation for every business."

Steps to Prepare

Our team advises clients on drafting comprehensive privacy policies, conducting Data Protection Impact Assessments (DPIAs), and training staff on secure data handling. We guide you through ODPC registration and ensure your terms of service are legally enforceable.