Kenya

Data Protection Act, 2019 (No. 24 of 2019, Cap. 411C) IN FORCE

commenced 2019-11-25 · Official full text ↗

Scope

Controllers/processors established or resident in Kenya, and those outside Kenya processing personal data of data subjects located in Kenya.

Key obligations

Processing principles (s.25) and lawful bases incl. consent (s.30-32); Mandatory registration with ODPC above thresholds (Registration Regulations 2021); DPIA for high-risk processing (s.31); Data subject rights: access, correction, erasure, portability (ss.26, 34-40)

DPO required

Required for public bodies and controllers/processors whose core activities involve regular and systematic monitoring or large-scale special-category processing (s.24).

Registration

Yes: mandatory registration with ODPC, thresholds per 2021 Regulations.

Cross-border transfers

Transfers outside Kenya require proof of appropriate safeguards or adequacy, or data-subject consent (ss.48-50); sensitive data transfers further restricted.

Breach notification

Notify ODPC within 72 hours where there is a real risk of harm; communicate to data subject in writing (s.43).

Penalties

Administrative fines up to KES 5,000,000 or 1% of annual turnover, whichever is lower (s.63); compensation orders (s.65); criminal offences for unlawful disclosure.

Authority

Office of the Data Protection Commissioner (ODPC)

Verified 2026-07-06

Access to Information Act 2016 IN FORCE