Data protection compliance in Kenya
Kenya's Data Protection Act is actively enforced by the ODPC. We help tech companies register, close their compliance gaps and stay compliant as they grow.
Key facts
- Main law
- Data Protection Act, 2019, with the 2021 General, Registration and Compliance & Enforcement Regulations
- Regulator
- Office of the Data Protection Commissioner (ODPC)
- Registration
- Data controllers and processors must register with the ODPC. Small businesses may be exempt, but not in sectors where registration is mandatory, such as health, education and financial services.
- Breach notification
- Notify the ODPC within 72 hours of becoming aware of a personal data breach, and inform affected people where there is a high risk to them.
- Penalties
- Administrative fines of up to KES 5 million or 1% of annual turnover, whichever is lower, plus enforcement notices and compensation claims.
General information, last reviewed October 2026. Laws and regulator practice change, so confirm specifics with our team. This is not legal advice.
What you need to do
- Register with the ODPC and renew your registration on time
- Have a lawful basis, such as consent, for every way you use personal data
- Give clear privacy notices and respect data subject rights (access, correction, deletion, objection)
- Run a Data Protection Impact Assessment (DPIA) before high-risk processing
- Apply extra safeguards to sensitive data such as health, biometric and financial information
- Put safeguards in place before transferring personal data outside Kenya
- Keep records of processing and be ready for an ODPC compliance audit
Compliance in Kenya, handled
Registration
We prepare and submit your registration with the regulator.
Gap assessment
We review your product and operations against the law and give you a clear fix list.
Implementation
We fix the gaps in your policies, processes and code, including consent, audit logs and access control.
Outsourced DPO
We act as your Data Protection Officer on a monthly retainer.
Operating in more than one country? See our guides for Uganda, Tanzania, Rwanda, or read our East Africa expansion checklist.
Ready to talk?
Book a free 30-minute consultation. Tell us what you're building and we'll tell you what to fix first.