Kenya Data Protection Act: A Practical Guide for Businesses

Almost every business collects personal data: customer names and phone numbers, staff records, M-Pesa transaction details, CVs, CCTV footage. In Kenya, the Data Protection Act, 2019 sets out how that data must be handled, and the Office of the Data Protection Commissioner (ODPC) oversees compliance. This guide explains the practical steps most organisations should take.

This article is general guidance, not legal advice. For your specific obligations, consult a qualified advisor or the ODPC’s published guidance.

The core principles

The Act is built on principles that are easy to state and worth building into everyday habits. Personal data should be:

• Collected for a clear, lawful purpose that you explain to the person
• Limited to what you actually need for that purpose
• Accurate and kept up to date
• Kept no longer than necessary
• Protected against loss, misuse and unauthorised access

Practical steps for your business

1. Map the personal data you hold

List what personal data you collect, why, where it is stored, who can access it and how long you keep it. Include spreadsheets, email inboxes, WhatsApp groups and paper files, not just formal systems.

2. Check whether you need to register

Many organisations that collect or process personal data are required to register with the ODPC as data controllers or processors. Check the current registration requirements and thresholds on the ODPC website.

3. Be transparent

Publish a clear privacy notice on your website and forms explaining what you collect and why. Where you rely on consent, for example for marketing messages, make it a genuine choice that people can withdraw.

4. Secure the data

Use strong passwords and two-factor authentication, restrict access by role, encrypt sensitive data, keep systems updated and back up regularly. Our article on cybersecurity basics covers the essentials.

5. Respect people’s rights

People have rights to access their data, correct it and, in some cases, have it deleted. Decide who in your organisation handles these requests and how quickly.

6. Prepare for incidents

Have a simple plan for what to do if data is lost or exposed: who investigates, how you contain the problem, and how you notify the ODPC and affected people where required.

Build privacy into your systems

It is far easier to comply when your software is designed for it. The systems we build include role-based access, audit trails of who viewed or changed records, encrypted sensitive fields and the ability to export or delete a person’s data on request.

Our IT consultancy team can review how your systems collect and store personal data and recommend practical improvements aligned with the Act.