Kenya
SubstantialData Protection Act 2019
Authority: Office of the Data Protection Commissioner (ODPC) | Enforcement: Active | Enacted: November 2019
Overview
Kenya's Data Protection Act 2019 was one of the first comprehensive data protection laws in East Africa. The ODPC has been actively issuing guidance and registering data controllers and processors.
14-Topic Coverage
Data Protection Authority
Fully AddressedODPC oversees compliance, registration, and enforcement.
Consent Requirements
Fully AddressedConsent must be express, informed, and given freely for a specific purpose.
Data Subject Rights
Fully AddressedRights to be informed, access, rectification, deletion, and data portability.
Cross-Border Transfer
Fully AddressedTransfers to countries with adequate protection or with appropriate safeguards.
Breach Notification
Fully AddressedMust notify ODPC within 72 hours and affected data subjects without unreasonable delay.
DPO Requirements
Partially AddressedDPO required for certain categories of controllers.
Children's Data
Fully AddressedParental consent required for children under 18.
Penalties & Enforcement
Fully AddressedFines up to KES 5 million or 1% of annual turnover. Criminal penalties for certain offences.
Sector-Specific Rules
Partially AddressedCBK financial data rules, health data regulations, telecom requirements.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Not AddressedNo specific AI or automated decision provisions.
Data Localisation
Not AddressedNo general data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Partially AddressedDPA applies to government. National security exemptions apply.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Kenya's regulations.
Book a Consultation