Data Protection Act, 2019 (Kenya)

The Kenya Data Protection Act, 2019 (Act No. 24 of 2019) was assented to on November 8, 2019 and commenced on November 25, 2019. The Act is published on Kenya Law (kenyalaw.org) and is the framework data protection statute for the Republic of Kenya. It implements Article 31(c) and (d) of the 2010 Constitution of Kenya, which establishes a right to privacy that includes protection of personal information. The statute is administered by the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke, which was operationalized in late 2020 with the appointment of Immaculate Kassait as the first Data Commissioner. The ODPC has issued three sets of subsidiary regulations: the Data Protection (General) Regulations 2021, the Data Protection (Compliance and Enforcement) Regulations 2021, and the Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021. Those regulations carry the day-to-day operational detail, including registration thresholds, complaint procedures, and enforcement steps. The Act applies to a data controller or processor established or ordinarily resident in Kenya that processes personal data while in Kenya, and to a controller or processor outside Kenya that processes personal data of data subjects located in Kenya. That extraterritorial reach pulls in foreign SaaS vendors that target Kenyan customers, even when they have no local entity. Registration with the ODPC is mandatory for controllers and processors above thresholds set by the Registration Regulations 2021. The regulations exempt entities with annual turnover or revenue below KES 5 million and fewer than 10 employees, unless they process certain high-risk categories such as data of children, sensitive personal data at scale, health data, financial data, or fall into listed sectors including telecommunications, financial services, education, betting, transport, and direct marketing. Data subject rights under Sections 26 and 34 include the right to be informed, the right to access, the right to object, the right to correction, the right to deletion, and the right to portability. Lawful processing bases under Section 30 include consent, contract performance, legal obligation, vital interests, public interest, and legitimate interest. Sensitive personal data under Section 44 (health, genetic, biometric, child data, sex life, sexual orientation, race, ethnicity, religion, political opinions, marital status, family details, criminal record) requires either explicit consent or another listed condition. Breach notification under Section 43 requires the controller to notify the Data Commissioner within 72 hours of becoming aware of a personal data breach that affects rights and freedoms of data subjects, and to notify affected data subjects without unreasonable delay when the breach poses a real risk of harm. The ODPC has imposed administrative fines on multiple controllers since 2022, including a KES 5 million fine against Oppo Kenya in 2023 and earlier fines against digital lenders for unauthorized contact-list scraping. Kenya is the operational center of East Africa for many multinationals, hosts M-PESA, and is the headquarters location for African Union telecommunications projects, which means the Kenya DPA functions as the privacy floor for cross-border services across Kenya, Tanzania, Uganda, and Rwanda for many vendors. The Act is closely modeled on GDPR principles, so EU-aligned controls transfer well.