Regulations › Rest of world › Kenya
DPA (Kenya)
Data Protection Act, 2019 (Kenya)
WhenIn effect since 25 November 2019
Who enforces itOffice of the Data Protection Commissioner (ODPC)
Who it applies toData controllers and processors established or processing personal data in Kenya.
Tell the regulatorNotify the Data Commissioner within 72 hours of becoming aware where there is a real risk of h…
DPO requiredControllers and processors may appoint a DPO for public or private bodies, systematic monitori…
RegistrationControllers and processors must register, pay tiered fees (KES 4,000-40,000) and renew every 2…
Transfers abroadTransfers need proof of appropriate safeguards to the Data Commissioner or a listed condition
Request deadline7 days for access
Maximum fineUp to KES 5 million or 1% of prior-year annual turnover, whichever is lower (about USD 39,000…
Data protection authority Office of the Data Protection Commissioner (ODPC)
- Address
- Britam Tower, 12th and 13th Floor, Hospital Road, Upper Hill, Nairobi✓
- info@odpc.go.ke enquiries@odpc.go.ke ✓
- Phone
- +254 20 7801800 +254 796 954269 +254 752 896867 ✓
- Website
- odpc.go.ke
- Register
- Registration portal✓
- Breaches
- Report a breach✓
The ODPC lists 11 regional offices on its contact page.
Checked 18 Oct 2026. ✓ confirmed on the authority's own site. Report a change
Local help in Kenya
Law firms, training centers and other providers in Kenya can apply to be listed here. We check each one before it shows.
List your organizationRegulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws