Kenya Data Protection Act Compliance with ConsentX

What is the Kenya Data Protection Act?

The Data Protection Act No. 24 of 2019 gives effect to the privacy protections contained in Article 31 of the Constitution of Kenya.

The Act establishes rules for the processing of personal data and creates the Office of the Data Protection Commissioner as Kenya's independent data protection regulator. The ODPC is responsible for overseeing implementation and enforcement of the Act, maintaining the register of data controllers and processors, investigating complaints, and exercising regulatory oversight.

The Kenyan framework is supplemented by regulations and regulatory guidance, including:

• Data Protection (General) Regulations, 2021
• Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021
• Data Protection (Complaints Handling and Enforcement) Regulations, 2021
• Data Protection (Civil Registration) Regulations, 2020
• ODPC guidance on consent
• ODPC guidance on DPIAs
• ODPC guidance on cross-border data transfers
• Sector-specific guidance issued by the ODPC

Does the Kenya DPA apply to organizations outside Kenya?

The Kenyan framework can apply to organizations processing personal data relating to individuals in Kenya even where the organization itself is located outside Kenya, depending on the circumstances and territorial scope of the Act.

Organizations serving Kenyan users should therefore assess whether their activities bring them within the DPA and whether they have registration, representative, transfer, or other compliance obligations.

What is personal data under the Kenya DPA?

Personal data broadly refers to information relating to an identified or identifiable natural person.

Examples include:

• Name
• Email address
• Telephone number
• Identification information
• Location information
• Employment information
• Financial information
• Online identifiers
• Health information
• Biometric information
• Family information

Organizations should assess data across the complete processing lifecycle rather than focusing only on information explicitly labelled as “personal data”.

Key principles of data protection in Kenya

The Kenya DPA requires personal data to be processed in accordance with core data protection principles.

Lawful, fair and transparent. Organizations should process personal data lawfully and transparently in relation to the data subject.

Collected for specified purposes. Data should be collected for explicit, specified and legitimate purposes and should not subsequently be used in an incompatible manner.

Adequate and relevant. Organizations should limit personal data to what is necessary for the stated purpose.

Accurate. Reasonable steps should be taken to ensure that inaccurate personal data is corrected or erased without undue delay.

Subject to storage limitation. Personal data should not be retained in identifiable form longer than necessary for the purpose for which it was collected.

Secure. Appropriate technical and organizational safeguards must be used to protect personal data.

These principles form the foundation of Kenya's privacy framework.

Lawful bases for processing personal data in Kenya

Consent is not the only basis for processing personal data under the Kenyan framework.

Organizations should identify the appropriate legal basis for each processing activity. Depending on the circumstances, processing may be permitted where it is necessary for purposes recognized by the Act, including contractual, legal, regulatory, public-interest, or other statutory grounds.

Where consent is relied upon, the consent must satisfy the requirements of the DPA and applicable regulations.

This distinction is important because organizations should not design their entire privacy program around consent alone.

Consent under the Kenya Data Protection Act

Where consent is used as the legal basis, Kenya's framework requires consent to be meaningful and informed.

Consent is generally understood as an express, unequivocal, free, specific and informed indication of the data subject's wishes through a statement or clear affirmative action.

The Data Protection (General) Regulations, 2021 require organizations seeking consent to provide relevant information including:

• Identity of the controller or processor
• Purpose of each processing activity
• Types of personal data being collected
• Relevant automated decision-making information
• Potential risks associated with certain data transfers
• Whether data will be shared with third parties
• Right to withdraw consent
• Implications of providing, withholding, or withdrawing consent

A compliant consent mechanism should generally:

• Clearly identify what the individual is agreeing to
• Use understandable language
• Avoid coercion
• Separate consent from unrelated purposes
• Use a clear affirmative action
• Allow withdrawal where consent is the legal basis
• Maintain evidence of the consent decision

ConsentX can help organizations capture and retain this evidence for digital consent journeys.

Consent withdrawal

Where processing is based on consent, individuals should be able to withdraw consent.

Withdrawal should be reasonably accessible and should not require substantially more effort than providing consent.

Organizations should also ensure that withdrawal triggers the appropriate operational response across connected systems and processing activities.

Sensitive personal data under Kenya's DPA

Kenya provides additional protection for sensitive personal data.

The statutory and regulatory framework recognizes categories including information relating to:

• Health
• Race
• Ethnic or social origin
• Conscience or beliefs
• Genetic data
• Biometric data
• Property details
• Marital status
• Family details
• Sex
• Sexual orientation

The ODPC has also issued guidance addressing specific sensitive-data categories such as biometric information and health data.

Organizations processing sensitive personal data should assess:

• Whether processing is legally permitted
• Whether consent is required
• Whether a DPIA is necessary
• Security controls
• Access restrictions
• Retention periods
• Data-sharing arrangements
• Cross-border transfer requirements

The ODPC also published a draft notice in September 2026 proposing additional categories of sensitive personal data. Because that document is expressly identified as a draft, it should not be treated as final law unless and until adopted.

Children's personal data

Kenya's DPA provides specific protections for children's personal data.

Organizations processing children's information should assess:

• Whether parental or guardian consent is required
• Whether the processing is in the child's best interests
• Whether age verification is appropriate
• Whether additional safeguards are necessary
• Whether the processing involves sensitive information

The ODPC has published specific guidance on the processing of children's data.

Privacy notices and transparency

Organizations should provide data subjects with appropriate information about how their personal data is processed.

Privacy notices should generally explain:

• Identity of the organization
• Contact details
• Purposes of processing
• Categories of personal data
• Legal basis where appropriate
• Recipients or categories of recipients
• Retention information
• International transfers
• Data subject rights
• Complaint mechanisms
• Relevant automated decision-making
• How consent can be withdrawn where applicable

Transparency should be maintained throughout the processing lifecycle, not only at initial collection.

Data subject rights under Kenya's DPA

Kenya's framework gives individuals a range of rights concerning their personal data.

Right to be informed. Individuals have a right to know how their personal data is being used.

Right of access. Individuals can request access to personal data held about them.

Right to rectification. Individuals can request correction of inaccurate or misleading personal data.

Right to erasure. Individuals can request deletion of personal data in circumstances provided by law.

Right to object. Individuals may object to certain processing activities.

Right to restrict processing. The framework recognizes restrictions on processing in applicable circumstances.

Right to data portability. Individuals can have personal data ported between controllers or processors in circumstances prescribed by law.

The ODPC expressly lists these rights in its public guidance and data protection materials.

Data Subject Access Requests (DSARs)

Organizations should establish a structured process for receiving, verifying, tracking, and responding to data-subject requests.

A DSAR management process should include:

• Request intake
• Identity verification
• Request classification
• Internal data discovery
• Review of applicable exemptions
• Response preparation
• Secure delivery
• Audit logging

ConsentX can support the workflow and evidence layer for rights requests.

Data Protection Impact Assessment (DPIA)

A Data Protection Impact Assessment is an important part of Kenya's risk-based compliance framework.

A DPIA should be considered where processing is likely to result in a high risk to the rights and freedoms of individuals.

Examples may include:

• Large-scale sensitive-data processing
• Biometric processing
• Systematic monitoring
• New technologies
• Extensive profiling
• High-risk automated processing
• Processing involving vulnerable individuals

The ODPC has published a dedicated DPIA guidance note and provides guidance on when and how assessments should be conducted.

Data Protection Officer (DPO)

The DPA provides for the designation or appointment of a Data Protection Officer in specified circumstances.

These include situations involving:

• Public bodies, except courts acting in their judicial capacity
• Regular and systematic monitoring of data subjects as a core activity
• Processing of sensitive categories of personal data as a core activity

A DPO may perform other responsibilities provided they do not create a conflict of interest.

Organizations should also publish the DPO's contact details and communicate them to the Data Commissioner where required.

Data security under the Kenya DPA

Organizations must implement appropriate safeguards to protect personal data against risks such as:

• Unauthorized access
• Accidental loss
• Destruction
• Alteration
• Unauthorized disclosure
• Unlawful processing

Security controls may include:

• Encryption
• Access controls
• Authentication
• Multi-factor authentication
• Network security
• Data masking
• Logging and monitoring
• Backup and recovery
• Incident response
• Employee training
• Vendor controls

The ODPC's registration portal itself asks organizations to provide information about their technical and organizational safeguards.

Data breach notification in Kenya

Kenya establishes specific breach notification obligations.

Where a personal data breach meets the statutory requirements, a data controller must notify the Data Commissioner without delay and within 72 hours of becoming aware of the breach.

The controller may also need to communicate with affected data subjects within a reasonably practicable period, subject to the conditions and exceptions provided by the Act.

A data processor that becomes aware of a personal data breach must notify the relevant data controller without delay and, where reasonably practicable, within 48 hours.

A breach response program should therefore include:

• Incident detection
• Risk assessment
• Breach classification
• Internal escalation
• Regulator notification
• Data-subject notification where required
• Remediation
• Documentation
• Post-incident review

International and cross-border data transfers

Personal data transferred outside Kenya must satisfy the requirements of the DPA and applicable regulations.

The framework recognizes mechanisms including:

• Adequate data protection safeguards
• Appropriate safeguards
• Transfers based on necessity in specified circumstances
• Explicit consent where applicable

Where consent is relied upon for an international transfer, the individual should be informed of the potential risks and explicitly consent to the proposed transfer. Additional requirements apply to sensitive personal data.

Organizations should maintain visibility into:

• Destination countries
• Overseas recipients
• Categories of data transferred
• Purpose of transfer
• Transfer mechanism
• Contractual safeguards
• Security controls

Data localization and Kenya

Kenya's framework does not impose a blanket requirement that all personal data must remain physically inside Kenya.

However, organizations may have specific obligations depending on the nature of the processing, sector, data involved, and applicable regulatory requirements.

Data-transfer assessments should therefore be performed before moving personal data to an overseas provider.

The ODPC's current compliance materials also request organizations to identify jurisdictions where data is transferred or stored.

Data processors and third parties

Organizations remain responsible for carefully managing third-party processing arrangements.

Vendor management should address:

• Processing instructions
• Purpose limitation
• Confidentiality
• Security
• Sub-processors
• Data retention
• Data deletion
• Breach notification
• International transfers
• Data-subject requests
• Audit and compliance assistance

A written data processing arrangement should clearly allocate responsibilities between controllers and processors.

Data retention and deletion

Personal data should not be retained in identifiable form for longer than necessary for the purpose for which it was collected.

Organizations should maintain:

• Data retention schedules
• Deletion procedures
• Archival rules
• Legal-hold procedures
• Automated deletion workflows
• Records of deletion where appropriate

Retention periods should be based on the purpose of processing and applicable legal, regulatory, contractual, and operational requirements.

Direct marketing and electronic communications

Organizations using personal data for direct marketing should carefully assess:

• The lawful basis for processing
• Transparency requirements
• Consent requirements where applicable
• Opt-out mechanisms
• Purpose limitation
• Data-sharing practices
• Marketing suppression lists

Marketing preferences should be recorded and respected across relevant systems.

For digital marketing, ConsentX can help organizations capture and document user preferences and manage consent signals across websites and connected technologies.

Cookies and online tracking under Kenya's DPA

The Kenya DPA regulates personal data processing, meaning cookies and online trackers should be assessed according to whether and how they process personal data.

Organizations should identify:

• Analytics cookies
• Advertising cookies
• Social-media pixels
• Retargeting technologies
• Device identifiers
• Fingerprinting technologies
• Third-party scripts

A cookie banner should not simply display a message. Organizations should understand which technologies are active, what information they collect, the purpose of processing, and the legal basis being relied upon.

Where consent is required, non-essential tracking should not be activated before valid consent is obtained.

Automated decision-making and profiling

Organizations using automated decision-making or profiling should assess whether the processing creates legal or significant effects for individuals.

Relevant considerations include:

• Transparency
• Purpose limitation
• Legal basis
• Data minimization
• Accuracy
• Human oversight
• Security
• Data-subject rights
• DPIA requirements

The General Regulations also require relevant information about automated decision-making to be provided when seeking consent where applicable.

Privacy by design and by default

Privacy should be incorporated into systems and processes from the beginning rather than added after deployment.

Organizations should consider:

• Collecting only necessary data
• Default privacy settings
• Role-based access
• Encryption
• Data minimization
• Retention limits
• Consent controls
• Audit logs
• Secure deletion

The ODPC's compliance assessment materials specifically ask organizations to demonstrate how privacy by design or default is implemented.

Registration of data controllers and processors

Registration is a significant part of Kenya's compliance framework.

The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 establish registration requirements, exemptions, application procedures, certificates, renewals, and related obligations.

Organizations should determine whether they are required to register as:

• Data controller
• Data processor
• Both controller and processor

The ODPC maintains an online register of registered data handlers and provides an online registration portal.

The regulations provide an exemption for certain organizations below specified turnover or revenue and employee thresholds, but the exemption does not apply to organizations processing personal data for specified categories of activities listed in the regulations. Organizations should therefore assess both:

• Their size and employee or revenue position
• The nature of their processing activities

Compliance audits

The Data Commissioner has authority to carry out periodic audits of the processes and systems of data controllers and processors.

Organizations should therefore maintain evidence of compliance rather than relying solely on written policies.

Useful evidence includes:

• Consent records
• Privacy notices
• Data maps
• Processing registers
• DPIAs
• Vendor agreements
• Security controls
• Breach records
• DSAR records
• Retention schedules
• Training records
• Registration certificates
• Audit reports

Enforcement by the ODPC

The Office of the Data Protection Commissioner (ODPC) is Kenya's primary data protection regulator.

Its functions include:

• Enforcing the DPA
• Maintaining the register of controllers and processors
• Investigating complaints
• Conducting oversight
• Conducting investigations
• Issuing enforcement notices
• Issuing penalty notices
• Providing regulatory guidance
• Protecting data-subject rights

The ODPC also provides mechanisms for individuals to file complaints and for organizations to report data breaches.

Penalties under Kenya's Data Protection Act

The Data Commissioner may impose administrative penalties for infringements of the Act.

The maximum administrative penalty under section 63 is up to KES 5 million, or for an undertaking, up to 1% of its annual turnover in the preceding financial year, whichever is lower.

The amount of a particular penalty depends on the circumstances and statutory factors considered by the Commissioner.

Organizations may also face other enforcement measures, and individuals who suffer damage as a result of a contravention may have rights to compensation under the Act.

Kenya DPA compliance checklist

Organizations operating under Kenya's Data Protection Act should consider the following checklist.

• Determine whether the DPA applies
• Map personal-data processing activities
• Identify controller and processor roles
• Identify lawful bases for processing
• Review consent mechanisms
• Provide appropriate privacy notices
• Identify sensitive personal data
• Assess children's data processing
• Determine whether registration with ODPC is required
• Appoint a DPO where required
• Implement security safeguards
• Establish a breach-response procedure
• Maintain the 72-hour regulator-notification capability
• Establish processor-to-controller breach escalation
• Conduct DPIAs where required
• Review international data transfers
• Implement retention and deletion procedures
• Establish DSAR workflows
• Maintain marketing preferences and opt-outs
• Review automated decision-making and profiling
• Maintain audit evidence
• Regularly review privacy policies and procedures

Why consent management matters for Kenya

Consent management is only one part of DPA compliance, but it becomes particularly important where an organization relies on consent as its lawful basis.

A strong consent-management system can help organizations:

• Collect meaningful consent
• Provide clearer choices
• Document consent
• Manage withdrawals
• Maintain preference history
• Control website trackers
• Demonstrate compliance
• Support audits
• Coordinate privacy preferences across jurisdictions

ConsentX is designed to provide the technical infrastructure for these activities.