Kenya's Data Protection Act 2019 makes registration with the Office of the Data Protection Commissioner (ODPC) a precondition for most processing, and it treats leaked login credentials as a breach with a real risk of harm that must reach the Data Commissioner within 72 hours. The Act came into force on 25 November 2019 and is operated through three 2021 regulations: the Data Protection (General) Regulations, the Registration of Data Controllers and Data Processors Regulations, and the Complaints Handling and Enforcement Regulations. This guide covers scope, registration, the security and breach duties, DPIAs, transfers and data localisation, enforcement, and what the regime means for AI agents and machine credentials. It is written for security, privacy and engineering leads at organisations that process personal data of people in Kenya, whether or not they are established there.
Key takeaways
- Registration is the default: every controller and processor must register unless exempt, and the small-business exemption (turnover under KSh 5 million and fewer than 10 employees) does not apply to listed sectors such as financial services, health, education, telecoms and direct marketing.
- 72 hours to the Commissioner, 48 hours from processors: section 43 requires controllers to notify within 72 hours of becoming aware of a breach with a real risk of harm, and processors to tell the controller within 48 hours.
- Credentials count: General Regulation 37 treats a breach involving an account's login credentials as one with a real risk of harm, which brings leaked passwords and tokens into scope.
- Transfers need proof: section 48 requires proof of appropriate safeguards to be given to the Commissioner, and Regulation 26 requires some strategic-interest processing to stay on servers in Kenya.
- Penalties are capped but frequent: penalty notices reach KSh 5 million or 1% of turnover, whichever is lower, and the ODPC publishes a steady stream of determinations and penalty notices.
Scope: who and what is covered
The Act (No. 24 of 2019) was assented to on 8 November 2019 and commenced on 25 November 2019. Section 4 applies it to processing by a controller or processor established or ordinarily resident in Kenya, and by one not established in Kenya that processes personal data of data subjects located in Kenya. The ODPC, headed by the Data Commissioner, regulates and enforces it.
| Element | Kenyan position | Reference |
|---|---|---|
| Data controller | Determines the purpose and means of processing, alone or jointly | Act s2; Registration Reg 4(2) |
| Data processor | Processes on the controller's behalf under contract, with no decision-making power over purpose or means | Registration Reg 4(2); Act s42 |
| Sensitive personal data | Includes race, health, ethnic social origin, conscience, belief, genetic and biometric data, property details, marital status, family details and sex or sexual orientation | Act s2, Part IV |
| Data Protection Officer | May be designated, and is expected where the core activity is regular and systematic monitoring, sensitive data processing, or by a public body | Act s24 |
| Small-entity exemption | Turnover or revenue under KSh 5 million and fewer than 10 employees, unless processing for a Third Schedule purpose; exempt entities still comply with the Act's principles and rights | Registration Reg 13 |
Key obligations
Registration with the ODPC
Registration is made on the ODPC data portal (dataportal.odpc.go.ke) under sections 18 and 19, which require a description of the personal data, purposes, categories of data subjects and safeguards. The Registration Regulations (Legal Notice 265 of 2021) set the detail.
| Category | Size test | Registration fee (KSh) | Renewal every 24 months (KSh) |
|---|---|---|---|
| Micro and small | 1 to 50 employees, turnover up to KSh 5 million | 4,000 | 2,000 |
| Medium | 51 to 99 employees, turnover KSh 5 million to 50 million | 16,000 | 9,000 |
| Large | Over 99 employees, turnover over KSh 50 million | 40,000 | 25,000 |
| Public entities, charities and religious entities | Any | 4,000 | 2,000 |
- Mandatory sectors (Third Schedule): canvassing political support; crime prevention and prosecution including CCTV; gambling; education; health administration and patient care; hospitality; property management and land sales; financial services; telecommunications; direct marketing; transport including ride-hailing; and genetic data.
- Validity: a certificate lasts 24 months (Reg 9) and must be renewed (Reg 11).
- Changes: notify changes to registered particulars in writing within 14 days (Reg 15(1)); failing to do so is an offence (Reg 15(4)).
- Offences: processing without registration, after expiry, or on false information is an offence (Reg 18), and the Commissioner can cancel or vary a registration (Reg 16).
Principles, rights and request deadlines
Section 25 requires lawful, fair and transparent processing, specified purposes, minimisation, accuracy and limited retention, and bars transfers abroad without proof of adequate safeguards or consent. Section 26 and sections 34 to 40 give rights to be informed, to access, object, restrict, port, rectify and erase. Section 35 protects against decisions based solely on automated processing that significantly affect the data subject. The General Regulations (Legal Notice 263 of 2021) set response clocks that systems must meet:
| Request | Deadline | Regulation |
|---|---|---|
| Access (free of charge) | 7 days | Reg 9 |
| Restriction, objection, rectification, erasure | 14 days | Regs 7(3), 8(3), 10(4), 12(3) |
| Portability | 30 days | Reg 11(3) |
| Stop third-party direct marketing | 7 days | Reg 18(3) |
Regulation 19 requires a retention schedule with time limits and periodic audits, and erasure, anonymisation or pseudonymisation when the purpose lapses.
Security safeguards: sections 41 and 42 and Regulation 32
- By design and default: section 41 requires technical and organisational measures, minimisation by default, and measures such as pseudonymisation and encryption.
- Processors: section 42 requires processors to act on the controller's instructions under a written contract that binds them to the same measures.
- The security elements regulators test: Regulation 32 lists information security policies, risk assessments, access limited to authorised staff, secure storage and transfer, back-ups and logs, audit trails, breach detection and vulnerability testing.
Breach notification: section 43 and Regulations 37 and 38
| Element | Rule | Reference |
|---|---|---|
| Trigger | Personal data accessed or acquired by an unauthorised person and a real risk of harm to the data subject | Act s43(1) |
| Controller to Commissioner | Within 72 hours of becoming aware of the breach | Act s43(1)(a) |
| Controller to data subjects | In writing within a reasonably practical period, unless the identity cannot be established | Act s43(1)(b) |
| Processor to controller | Without delay and, where reasonably practicable, within 48 hours | Act s43(2) |
| Real risk of harm | Breaches involving Second Schedule data (for example income, bank account or card numbers, certain health data) or the login credentials for an account; publicly available data excluded | Reg 37 |
| Notice content | Nine items including date and circumstances of discovery, steps taken, number affected, data types, potential harm, remedial action and contact details, plus grounds if data subjects are not told | Reg 38 |
| Record | Keep a record of facts, effects and remedial action for every breach | Act s43 |
| Channel | ODPC "Report a Data Breach" form, which asks whether the report is more than 72 hours after discovery | ODPC website |
The ODPC form also asks for incident reports, incident response policies, sample agreements and copies of reports to other regulators or police, so keep those ready as attachments. For how Kenya's clock compares, see the Breach Notification Laws by Country Guide.
Data protection impact assessments
Section 31 requires a DPIA before processing likely to result in high risk, with consultation of the Commissioner where risk remains and the report submitted 60 days before processing. Regulation 49(1) lists ten high-risk types, including large-scale processing, biometric or genetic data, sensitive or children's data and systematic monitoring of public areas, and the Third Schedule gives the template. If the Commissioner does not respond within 60 days of submission, processing may proceed (Reg 52(3)). See the DPIA Guide: Running a Data Protection Impact Assessment.
Transfers and data localisation: sections 48 to 50
- Bases (Reg 40): appropriate safeguards, an adequacy decision, necessity, or the data subject's consent. Sensitive data needs consent plus confirmed safeguards (Act s49).
- Deemed safeguards (Reg 42): where the destination has ratified the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), has a reciprocal agreement with Kenya, or the group uses approved binding corporate rules (Reg 43).
- Necessity and consent (Regs 45 and 46): necessity must be strict; consent must be explicit and given after the risks are explained. Document every transfer (Reg 41).
- Localisation (s50, Reg 26): processing for civil registration and legal identity, elections, public finances, protected computer systems, early childhood and basic education, and primary or secondary health care must run on a server and data centre in Kenya, or keep at least one serving copy there.
See the International Data Transfers Map.
Timeline and current status
| Date | Event |
|---|---|
| 8 November 2019 | Data Protection Act assented |
| 25 November 2019 | Act in force |
| 2020 | Data Protection (Civil Registration) Regulations |
| 7 December 2021 | General, Registration and Complaints Handling and Enforcement Regulations made (Legal Notices 263 to 265, gazetted 31 December 2021) |
| 2023 onwards | ODPC publishes yearly determinations; 2023 includes a suo motu investigation of Worldcoin and Tools for Humanity |
| August 2025 | ODPC regulatory framework page last updated, listing no amendments to the Act or the 2021 Regulations |
As at the date of this guide, the ODPC lists the 2019 Act and the 2021 and 2020 Regulations as the operative framework. Check the ODPC regulatory framework and guidelines pages before relying on any threshold or fee, because the Commissioner can issue new guidance at any time.
Enforcement and penalties
The Commissioner investigates complaints and acts on its own motion, issuing determinations under Regulation 14 of the Complaints Handling and Enforcement Regulations.
| Tool | What it does | Reference |
|---|---|---|
| Enforcement notice | Orders specified corrective steps within a period of not less than 21 days; non-compliance without reasonable excuse is an offence (fine up to KSh 5 million, up to two years' imprisonment, or both) | Act s58 |
| Penalty notice | Up to KSh 5 million or, for an undertaking, up to 1% of annual turnover of the preceding year, whichever is lower | Act ss62-63 |
| Compensation | A person who suffers damage, including distress, may claim from the controller or processor | Act s65 |
| General offence penalty | Fine up to KSh 3 million, imprisonment up to ten years, or both, plus possible forfeiture of equipment | Act s73 |
| Commercial use without consent | Fine up to KSh 20,000, up to six months' imprisonment, or both | General Reg 15(4) |
The ODPC's press releases record penalty notices against Oppo Kenya, against Whitepath Company Limited and Regus Kenya, three penalty notices totalling KSh 9,375,000, an enforcement notice against a health service provider and an audit of 40 digital lenders. Its 2025 determinations page lists around 138 entries, including suo motu matters against schools, a hospital and a savings co-operative. The pattern is many small and medium organisations, often on CCTV, marketing and image use, rather than a few very large fines.
What it means for AI agents and non-human identities
- Leaked tokens are notifiable: because Regulation 37 names login credentials, a leaked API key or session token that opens an account holding personal data meets the real-risk-of-harm test. Treat secret exposure as a potential section 43 event, not just a hygiene issue. See the Secrets Management Guide.
- Agents need a registered purpose: the ODPC registration describes purposes and data categories. An AI agent that uses customer data for a new purpose may require an update within 14 days (Reg 15) and may be "further processing" that needs a new basis.
- Automated decisions: section 35 and Regulation 22 require notice, an explanation of the logic, human intervention on request, and steps to prevent error and bias. Agents that approve loans, flag fraud or close accounts are the obvious case. See the Agentic AI Compliance Guide.
- Model endpoints are transfers: sending prompts with Kenyan personal data to a model hosted abroad needs a Regulation 40 basis, and is off the table for Regulation 26 strategic-interest processing unless a serving copy stays in Kenya.
- Regulation 32 covers machines too: "access limited to authorised staff", logs and audit trails should extend to service accounts and agent identities, with owners, least privilege and rotation. See the Non-Human Identity (NHI) Guide.
Compliance steps
- Decide registration: test the Reg 13 exemption against the Third Schedule, register on the data portal and diary the 24-month renewal.
- Map processing: inventory data, purposes, processors, transfers and the human and machine identities that reach each store. See the Data Mapping and ROPA Guide.
- Wire up request handling: route access requests to a 7-day workflow and other rights to 14 days, with logging.
- Run DPIAs early: for Regulation 49 cases, submit at least 60 days before go-live where consultation is needed.
- Document transfers: record the Regulation 40 basis per destination, check Regulation 26 localisation, and file proof of safeguards with the Commissioner where section 48 requires it.
- Contract processors for 48 hours: write the section 43(2) 48-hour notice and the section 42 security duties into every processor contract. See the Third-Party Risk Management Guide.
- Rehearse the 72-hour path: pre-draft the nine Regulation 38 items and test a scenario that starts with a leaked credential. See the Incident Response Guide.
- Evidence Regulation 32: map controls to ISO/IEC 27001 or NIST CSF 2.0 so an ODPC investigation can see policies, risk assessments, logs and testing.
Framework mapping
| Kenyan duty | NIST CSF 2.0 | NIST SP 800-53 r5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Registration and legal requirements | GV.OC-03 | PT-2 | 5.31, 5.34 |
| Data and identity inventory | ID.AM-07, PR.AA-01 | AC-2 | 5.9, 5.16 |
| Security safeguards (s41, Reg 32) | PR.DS-01, PR.AA-05 | IA-5, AC-6, AU-2 | 8.5, 8.15, 8.24 |
| DPIA (s31, Reg 49) | GV.OC-03 | RA-8 | 5.34 |
| Processors (s42, s43(2)) | GV.SC-05 | SA-9 | 5.19, 5.20 |
| Breach detection and notice (s43, Regs 37-38) | DE.CM-01, RS.CO-02 | IR-6 | 5.24, 5.26 |
Metrics that show it is working
- Registration certificate current, with renewal raised at least 60 days before the 24-month expiry.
- Percentage of access requests closed within 7 days and other rights within 14 days.
- Median hours from secret-exposure alert to a documented section 43 decision.
- Percentage of processor contracts with a 48-hour breach clause.
- Percentage of service accounts, API keys and agent identities reaching personal data with a named owner and recent rotation.
Common failure patterns
- Assuming the exemption applies: small firms in health, education, hospitality or financial services must register regardless of size.
- Letting the certificate lapse: processing after expiry without renewal is an offence under Regulation 18.
- Treating credential leaks as non-events: Regulation 37 makes login credentials a real-risk-of-harm category.
- No 48-hour clause: processors notify late and the controller's 72 hours are already gone.
- Undocumented transfers: cloud, SaaS and AI services abroad with no recorded Regulation 40 basis or section 48 proof.
- Purpose drift: new AI or marketing uses that are not in the registration or the privacy notice.
Practitioner checklist
- Confirm registration status, the size category and the renewal date on the ODPC data portal.
- Check every processing purpose against the Third Schedule mandatory sectors.
- Notify registration changes within 14 days, including new AI-driven purposes.
- Meet the 7, 14 and 30-day request clocks and log every response.
- Treat exposed credentials and tokens as candidate section 43 breaches and triage within hours.
- Pre-draft the Regulation 38 notice and keep the ODPC form attachments ready.
- Put a 48-hour breach clause and section 42 security duties in every processor contract.
- Record the transfer basis per destination and apply Regulation 26 localisation where it bites.
- Extend Regulation 32 access, logging and audit controls to service accounts and agent identities.
Standards and references
- Republic of Kenya: Data Protection Act, No. 24 of 2019
- Republic of Kenya: Data Protection (General) Regulations, 2021
- Republic of Kenya: Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021
- Office of the Data Protection Commissioner: Regulatory framework
- Office of the Data Protection Commissioner: Report a data breach
- Office of the Data Protection Commissioner: Determinations
- Office of the Data Protection Commissioner: Press releases
Related NHI Mgmt Group resources: Nigeria Data Protection Act Guide · South Africa POPIA Guide · Global Privacy Regulatory Map · International Data Transfers Map. This guide summarises Kenya's Data Protection Act 2019 and its 2021 Regulations as published at the date above and is not legal advice.