Cookie consent in Kenya
Consent and privacy law in Kenya
Data Protection Act 2019, with registration regulations from 2022
en
Who must comply
Data controllers and processors established in Kenya, and those abroad that process personal data of data subjects in Kenya.
Penalties
Penalties up to 5 million Kenyan shillings or 1 percent of annual turnover
Key obligations
- Obtain express, free and specific consent where it is the basis
- Provide notice of purpose and rights before collection
- Honor access, rectification, erasure and objection rights
- Register as a data controller or processor where required
- Notify the commissioner and affected people of breaches
Local guidance
- Register with the ODPC where thresholds are met
- Use express, informed, and freely given consent
- Take special care in digital lending and marketing
- Apply GDPR-style rights and breach notification
How ConsentX helps
- Express, specific opt-in consent capture
- Direct-marketing opt-out controls
- Geo-aware banner for Kenyan visitors
- Rights request workflow with evidence
- Region rule engine tuned for Kenya
We value your privacy
We ask for your consent before any non-essential cookie, with the rules that apply in your region.
This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.
How to comply with Kenya using ConsentX
- 1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under Kenya.
- 2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that Kenya requires, automatically.
- 3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
- 4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a Kenya audit.
- 5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.
Frequently asked questions
Do I need to register with Kenya's ODPC?+
Many data controllers and processors must register with the Office of the Data Protection Commissioner, with thresholds set by the registration regulations of 2022.
Has Kenya enforced its data protection law?+
Yes. The ODPC has issued enforcement decisions and fines, notably in the digital lending sector for misusing borrowers' contacts and processing without proper consent.