Regulations › Rest of world › Kenya
DPA (Kenya)
Data Protection Act, 2019 (Kenya)
WhenIn effect since 25 November 2019
Who enforces itOffice of the Data Protection Commissioner (ODPC)
Who it applies toData controllers and processors established or processing personal data in Kenya.
Tell the regulatorNotify the Data Commissioner within 72 hours of becoming aware where there is a real risk of h…
DPO requiredControllers and processors may appoint a DPO for public or private bodies, systematic monitori…
RegistrationControllers and processors must register, pay tiered fees (KES 4,000-40,000) and renew every 2…
Transfers abroadTransfers need proof of appropriate safeguards to the Data Commissioner or a listed condition
Request deadline7 days for access
Maximum fineUp to KES 5 million or 1% of prior-year annual turnover, whichever is lower (about USD 39,000…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
3
Applies to controllers and processors outside Kenya that process personal data of data subjects located in Kenya.s.4(b)(ii) · source ↗
Lawful basis
1
Consent or listed necessity grounds, including legitimate interests unless unwarranted given harm to the data subject.s.30(1) · source ↗
Consent
2
Consent must be an express, unequivocal, free, specific and informed indication; the controller bears the burden of proof.s.2 (definition); s.32 · source ↗
Sensitive data
2
Sensitive personal data may be processed only on listed grounds; health data only by or under health professionals.ss.44-47 · source ↗
Children
3
Age 18. Processing requires parent or guardian consent and must serve the child's best interests; profiling children for direct marketing is barred.s.33; Reg. 13(2) · source ↗
The Act does not define child; 18 from the Children Act 2022 (not re-read).
People's rights
Rights
3
Information, access, objection, correction, deletion, restriction, portability, and the right not to be subject to solely automated decisions.ss.26, 34-36, 38, 40 · source ↗
Request deadline
3
7 days for access; 14 days for rectification, erasure, objection and restriction; 30 days for portability.Regs 7(3), 8(3), 9(4), 10(4), 11(3), 12(3), LN 263 of 2021 · source ↗
Marketing
3
Commercial use, including direct marketing, requires express consent; messages must carry a simple opt-out, and objection is absolute.s.37; Regs 14-17, LN 263 · source ↗
Governance
DPO required
1
Controllers and processors may appoint a DPO for public or private bodies, systematic monitoring, or sensitive data processing.s.24(1) · source ↗
Statute says 'may'; widely treated as expected practice. Contact details must go to the Data Commissioner (s.24(6)).
DPO qualifications
1
Relevant academic or professional qualifications and data protection knowledge; no named certification.s.24(5) · source ↗
Registration
3
Controllers and processors must register, pay tiered fees (KES 4,000-40,000) and renew every 24 months; small entities exempt unless in listed sectors.ss.18-19; Regs 4, 9, 11, 13, LN 265 of 2021 · source ↗
DPIA
3
DPIA required before high-risk processing, with a mandatory list; reports go to the Data Commissioner 60 days before processing.s.31; Regs 49-53, LN 263 · source ↗
s.31(5) does not clearly name the recipient; Reg. 52 deemed approval after 60 days implies submission to the Commissioner.
Records
2
No standalone record of processing duty; registration requires describing data, purposes, recipients and transfers, and breaches must be recorded.s.19(2); s.43(8) · source ↗
Level reflects processing details filed at registration, not an internal register.
Retention
2
Keep data only as long as reasonably necessary, maintain a retention schedule with periodic review, then erase or anonymize.s.39; Reg. 19, LN 263 · source ↗
Breaches
Tell the regulator
2
Notify the Data Commissioner within 72 hours of becoming aware where there is a real risk of harm; processors tell controllers within 48 hours.s.43(1)(a), (3) · source ↗
Tell people
2
Inform affected data subjects in writing within a reasonably practical period where there is real risk of harm, unless encryption or similar safeguards apply.s.43(1)(b), (6) · source ↗
Transfers
Transfers abroad
2
Transfers need proof of appropriate safeguards to the Data Commissioner or a listed condition; sensitive data needs consent.ss.48-49; Regs 39-48, LN 263 · source ↗
Localization
2
Data for listed public-good purposes (civil registration, elections, public finance, health, education) must be processed in Kenya or keep a serving copy there.s.50; Reg. 26, LN 263 · source ↗
Enforcement
Maximum fine
1
Up to KES 5 million or 1% of prior-year annual turnover, whichever is lower (about USD 39,000 maximum).s.63 · source ↗
Criminal liability
2
General penalty of up to KES 3 million or 10 years' imprisonment, or both, for offenses under the Act.s.73(1) · source ↗
Private action
2
Persons who suffer damage, including distress, are entitled to compensation from the controller or processor.s.65 · source ↗
ODPC also orders compensation; 184 orders reported for 2025.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws