ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXData Protection Act, 2019
Kenya
In force since 2019
Data Protection Act, 2019, supplemented by implementing regulations issued in 2020 and 2021 and by ODPC guidance.
Asia & Africa
Kenya
Data Protection Act, 2019
In force
Office of the Data Protection Commissioner (ODPC)
Data Protection Act, 2019 and implementing regulations issued in 2020 and 2021
Data controllers and data processors within the scope of the Act
One lawful basis for processing, subject to specific requirements
Mandatory for organizations falling within the registration requirements
Subject to additional safeguards
Subject to specific protections
Required for processing that presents a high risk to the rights and freedoms of data subjects
Subject to adequacy, safeguards, necessity, or consent requirements
Controllers must notify the Data Commissioner without delay and within 72 hours where the statutory threshold is met; processors must notify controllers without delay and, where reasonably practicable, within 48 hours
Up to KES 5 million or, for an undertaking, up to 1% of annual turnover of the preceding financial year, whichever is lower
The DPA applies to organizations that act as data controllers or data processors. A data controller determines the purposes and means of processing personal data; examples include e-commerce businesses, banks and financial institutions, employers, hospitals and healthcare organizations, educational institutions, telecommunications companies, SaaS companies, government bodies and marketing organizations. A data processor processes personal data on behalf of a data controller; examples include cloud service providers, payroll providers, CRM platforms, analytics providers, marketing technology companies, customer-support platforms and hosting providers. An organization may act as both a controller and processor depending on the processing activity, and the ODPC registration framework expressly recognizes entities that may require registration in both capacities.
The Data Commissioner may impose administrative penalties for infringements of the Act. The maximum administrative penalty under section 63 is up to KES 5 million, or for an undertaking, up to 1% of its annual turnover in the preceding financial year, whichever is lower. The amount of a particular penalty depends on the circumstances and statutory factors considered by the Commissioner. Organizations may also face other enforcement measures, and individuals who suffer damage as a result of a contravention may have rights to compensation under the Act.
Consent is an important lawful basis under the DPA, but Kenya's data protection framework is not based exclusively on consent. Organizations must identify an appropriate lawful basis for each processing activity and comply with the principles above.
The Data Protection Act No. 24 of 2019 gives effect to the privacy protections contained in Article 31 of the Constitution of Kenya.
The Act establishes rules for the processing of personal data and creates the Office of the Data Protection Commissioner as Kenya's independent data protection regulator. The ODPC is responsible for overseeing implementation and enforcement of the Act, maintaining the register of data controllers and processors, investigating complaints, and exercising regulatory oversight.
The Kenyan framework is supplemented by regulations and regulatory guidance, including:
The Kenyan framework can apply to organizations processing personal data relating to individuals in Kenya even where the organization itself is located outside Kenya, depending on the circumstances and territorial scope of the Act.
Organizations serving Kenyan users should therefore assess whether their activities bring them within the DPA and whether they have registration, representative, transfer, or other compliance obligations.
Personal data broadly refers to information relating to an identified or identifiable natural person.
Examples include:
Organizations should assess data across the complete processing lifecycle rather than focusing only on information explicitly labelled as “personal data”.
The Kenya DPA requires personal data to be processed in accordance with core data protection principles.
Lawful, fair and transparent. Organizations should process personal data lawfully and transparently in relation to the data subject.
Collected for specified purposes. Data should be collected for explicit, specified and legitimate purposes and should not subsequently be used in an incompatible manner.
Adequate and relevant. Organizations should limit personal data to what is necessary for the stated purpose.
Accurate. Reasonable steps should be taken to ensure that inaccurate personal data is corrected or erased without undue delay.
Subject to storage limitation. Personal data should not be retained in identifiable form longer than necessary for the purpose for which it was collected.
Secure. Appropriate technical and organizational safeguards must be used to protect personal data.
These principles form the foundation of Kenya's privacy framework.
Consent is not the only basis for processing personal data under the Kenyan framework.
Organizations should identify the appropriate legal basis for each processing activity. Depending on the circumstances, processing may be permitted where it is necessary for purposes recognized by the Act, including contractual, legal, regulatory, public-interest, or other statutory grounds.
Where consent is relied upon, the consent must satisfy the requirements of the DPA and applicable regulations.
This distinction is important because organizations should not design their entire privacy program around consent alone.
Where consent is used as the legal basis, Kenya's framework requires consent to be meaningful and informed.
Consent is generally understood as an express, unequivocal, free, specific and informed indication of the data subject's wishes through a statement or clear affirmative action.
The Data Protection (General) Regulations, 2021 require organizations seeking consent to provide relevant information including:
A compliant consent mechanism should generally:
ConsentX can help organizations capture and retain this evidence for digital consent journeys.
Where processing is based on consent, individuals should be able to withdraw consent.
Withdrawal should be reasonably accessible and should not require substantially more effort than providing consent.
Organizations should also ensure that withdrawal triggers the appropriate operational response across connected systems and processing activities.
Kenya provides additional protection for sensitive personal data.
The statutory and regulatory framework recognizes categories including information relating to:
The ODPC has also issued guidance addressing specific sensitive-data categories such as biometric information and health data.
Organizations processing sensitive personal data should assess:
The ODPC also published a draft notice in September 2026 proposing additional categories of sensitive personal data. Because that document is expressly identified as a draft, it should not be treated as final law unless and until adopted.
Kenya's DPA provides specific protections for children's personal data.
Organizations processing children's information should assess:
The ODPC has published specific guidance on the processing of children's data.
Organizations should provide data subjects with appropriate information about how their personal data is processed.
Privacy notices should generally explain:
Transparency should be maintained throughout the processing lifecycle, not only at initial collection.
Kenya's framework gives individuals a range of rights concerning their personal data.
Right to be informed. Individuals have a right to know how their personal data is being used.
Right of access. Individuals can request access to personal data held about them.
Right to rectification. Individuals can request correction of inaccurate or misleading personal data.
Right to erasure. Individuals can request deletion of personal data in circumstances provided by law.
Right to object. Individuals may object to certain processing activities.
Right to restrict processing. The framework recognizes restrictions on processing in applicable circumstances.
Right to data portability. Individuals can have personal data ported between controllers or processors in circumstances prescribed by law.
The ODPC expressly lists these rights in its public guidance and data protection materials.
Organizations should establish a structured process for receiving, verifying, tracking, and responding to data-subject requests.
A DSAR management process should include:
ConsentX can support the workflow and evidence layer for rights requests.
A Data Protection Impact Assessment is an important part of Kenya's risk-based compliance framework.
A DPIA should be considered where processing is likely to result in a high risk to the rights and freedoms of individuals.
Examples may include:
The ODPC has published a dedicated DPIA guidance note and provides guidance on when and how assessments should be conducted.
The DPA provides for the designation or appointment of a Data Protection Officer in specified circumstances.
These include situations involving:
A DPO may perform other responsibilities provided they do not create a conflict of interest.
Organizations should also publish the DPO's contact details and communicate them to the Data Commissioner where required.
Organizations must implement appropriate safeguards to protect personal data against risks such as:
Security controls may include:
The ODPC's registration portal itself asks organizations to provide information about their technical and organizational safeguards.
Kenya establishes specific breach notification obligations.
Where a personal data breach meets the statutory requirements, a data controller must notify the Data Commissioner without delay and within 72 hours of becoming aware of the breach.
The controller may also need to communicate with affected data subjects within a reasonably practicable period, subject to the conditions and exceptions provided by the Act.
A data processor that becomes aware of a personal data breach must notify the relevant data controller without delay and, where reasonably practicable, within 48 hours.
A breach response program should therefore include:
Personal data transferred outside Kenya must satisfy the requirements of the DPA and applicable regulations.
The framework recognizes mechanisms including:
Where consent is relied upon for an international transfer, the individual should be informed of the potential risks and explicitly consent to the proposed transfer. Additional requirements apply to sensitive personal data.
Organizations should maintain visibility into:
Kenya's framework does not impose a blanket requirement that all personal data must remain physically inside Kenya.
However, organizations may have specific obligations depending on the nature of the processing, sector, data involved, and applicable regulatory requirements.
Data-transfer assessments should therefore be performed before moving personal data to an overseas provider.
The ODPC's current compliance materials also request organizations to identify jurisdictions where data is transferred or stored.
Organizations remain responsible for carefully managing third-party processing arrangements.
Vendor management should address:
A written data processing arrangement should clearly allocate responsibilities between controllers and processors.
Personal data should not be retained in identifiable form for longer than necessary for the purpose for which it was collected.
Organizations should maintain:
Retention periods should be based on the purpose of processing and applicable legal, regulatory, contractual, and operational requirements.
Organizations using personal data for direct marketing should carefully assess:
Marketing preferences should be recorded and respected across relevant systems.
For digital marketing, ConsentX can help organizations capture and document user preferences and manage consent signals across websites and connected technologies.
The Kenya DPA regulates personal data processing, meaning cookies and online trackers should be assessed according to whether and how they process personal data.
Organizations should identify:
A cookie banner should not simply display a message. Organizations should understand which technologies are active, what information they collect, the purpose of processing, and the legal basis being relied upon.
Where consent is required, non-essential tracking should not be activated before valid consent is obtained.
Organizations using automated decision-making or profiling should assess whether the processing creates legal or significant effects for individuals.
Relevant considerations include:
The General Regulations also require relevant information about automated decision-making to be provided when seeking consent where applicable.
Privacy should be incorporated into systems and processes from the beginning rather than added after deployment.
Organizations should consider:
The ODPC's compliance assessment materials specifically ask organizations to demonstrate how privacy by design or default is implemented.
Registration is a significant part of Kenya's compliance framework.
The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 establish registration requirements, exemptions, application procedures, certificates, renewals, and related obligations.
Organizations should determine whether they are required to register as:
The ODPC maintains an online register of registered data handlers and provides an online registration portal.
The regulations provide an exemption for certain organizations below specified turnover or revenue and employee thresholds, but the exemption does not apply to organizations processing personal data for specified categories of activities listed in the regulations. Organizations should therefore assess both:
The Data Commissioner has authority to carry out periodic audits of the processes and systems of data controllers and processors.
Organizations should therefore maintain evidence of compliance rather than relying solely on written policies.
Useful evidence includes:
The Office of the Data Protection Commissioner (ODPC) is Kenya's primary data protection regulator.
Its functions include:
The ODPC also provides mechanisms for individuals to file complaints and for organizations to report data breaches.
The Data Commissioner may impose administrative penalties for infringements of the Act.
The maximum administrative penalty under section 63 is up to KES 5 million, or for an undertaking, up to 1% of its annual turnover in the preceding financial year, whichever is lower.
The amount of a particular penalty depends on the circumstances and statutory factors considered by the Commissioner.
Organizations may also face other enforcement measures, and individuals who suffer damage as a result of a contravention may have rights to compensation under the Act.
Organizations operating under Kenya's Data Protection Act should consider the following checklist.
Consent management is only one part of DPA compliance, but it becomes particularly important where an organization relies on consent as its lawful basis.
A strong consent-management system can help organizations:
ConsentX is designed to provide the technical infrastructure for these activities.
Maintain evidence of user choices to help demonstrate how consent was collected and managed.
Discover and manage cookies, pixels, scripts, and other tracking technologies deployed on your website.
Prevent selected non-essential trackers from executing before the appropriate consent signal is obtained.
Use scanning and monitoring capabilities to identify website technologies that may require privacy review.
Apply Kenya-specific consent and privacy configurations alongside requirements applicable in other jurisdictions.
Help centralize and track privacy requests, including access, deletion, rectification, objection, and other supported requests.
Capture consent using clear, affirmative mechanisms and maintain records of who consented, when consent was given, what the individual consented to, which version of the notice was presented, which purposes were selected, and whether consent was withdrawn.
Build a more transparent and auditable privacy experience for users in Kenya. With ConsentX, organizations can manage consent, cookies, tracking technologies, consent records, privacy requests, and regional privacy experiences from one platform. Scan your website, configure your privacy controls, manage consent, and maintain evidence of user choices with ConsentX.
This page provides general information about Kenya's Data Protection Act, 2019 and related regulations and is not legal advice. Kenyan privacy requirements can depend on the nature of the organization, its role as controller or processor, the processing activity, the categories of personal data involved, the sector, international transfers and applicable ODPC guidance. Organizations should review the current legislation and ODPC guidance and obtain qualified Kenyan legal advice where appropriate.
Identify cookies, scripts, pixels, tags, and other technologies that may process personal data.
Separate necessary technologies from analytics, functional, advertising, personalization, and other categories based on your processing purposes.
Create a consent interface that clearly communicates the purposes and choices relevant to Kenyan users.
Configure prior-script blocking so selected trackers do not execute before the required consent signal.
Maintain auditable records showing the user's choices, timestamp, purposes, and relevant notice or consent version.
Give users a practical mechanism to change or withdraw consent where applicable.
Track data-subject requests through a centralized workflow and maintain evidence of responses.
Keep your consent and privacy configurations aligned with regulatory and organizational changes.
The applicable framework depends on the organization's operations, locations, users, data, and processing activities.
Kenya
Kenya
GDPR
UK GDPR
CCPA / CPRA
VCDPA
Colorado CPA
CTDPA
UCPA
TDPSA
Oregon OCPA
Montana MCDPA
Florida FDBR
LGPD
PIPEDA
DPDPA
PDPA
POPIA
FADP
Law 25
LFPDPPP
PDPL
Law 21.719
Law 1581
Law 29733
Law 18.331