Kenya Data Protection Act compliance consulting for registration, rights and breaches handled before the ODPC asks.

What it is

What is the Kenya Data Protection Act and what is it used for?

The Data Protection Act, 2019 is Kenya's personal data law. It gives effect to the constitutional right to privacy in Article 31(c) and (d), sets the principles every processing activity must follow, grants rights to the people the data describes, and places duties on data controllers, who decide why and how data is used, and on data processors, who handle it for them. It also created the Office of the Data Protection Commissioner, the ODPC, which registers controllers and processors, receives complaints and breach reports, and may audit processes and systems to check compliance.

For an organisation the Act is a set of working duties rather than a document to file. You register before you process, decide on what basis each activity is lawful, tell people what you do, answer their requests, assess high-risk processing before it starts, secure what you hold, report breaches quickly and move data out of Kenya only with the right conditions in place.

Current law. The Data Protection Act, 2019 (No. 24 of 2019) received assent on 8 November 2019 and commenced on 25 November 2019. It is supported by the Data Protection (General) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, in effect from 14 July 2022 according to the ODPC, and the Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021. There is no certificate of compliance with the Act; Sterling does not give legal advice and works alongside your legal advisers.

Who it is for

Who needs Kenya Data Protection Act compliance?

Any person, company, public authority or other body that acts as a controller or processor of personal data falls within the Act's registration and processing duties. The ODPC exempts only small entities below both a turnover threshold and a headcount threshold, and never those in the sectors where registration is always mandatory, such as education, health, financial services, telecommunications, hospitality, transport and direct marketing. Organisations come to Sterling for Kenyan data protection from four directions:

• A customer or partner asks for proof. Banks, telecoms operators, multinationals and platform partners send due-diligence questionnaires asking for the registration certificate, the data protection officer's details and evidence of breach and rights procedures.
• A tender requires it. When a tender asks bidders to show registration and data protection controls, the evaluator wants a policy that works in practice, not only on paper.
• The regulator has been in touch. A complaint, a breach report or an ODPC audit exposes gaps in records, notices or contracts, and the organisation needs a structured response and a programme that holds up afterwards.
• A group company or head office sets the rule. A parent already working to the GDPR or ISO/IEC 27701 needs its Kenyan entity registered and aligned, with local obligations such as registration and transfer conditions covered.

Requirements

What are the main Kenya Data Protection Act requirements?

The Act is organised in eleven Parts, from preliminary provisions through the establishment of the ODPC to enforcement, financial and delegated powers. The operational duties sit mainly in Parts III to VI, with detail added by the General Regulations. The list below is a plain-language summary at title level; your programme is checked against the Act and regulations themselves, with your legal advisers on questions of interpretation.

• Registration of data controllers and data processors (Part III): register with the Data Commissioner before acting as a controller or processor, renew the registration certificate, which the ODPC states is valid for 24 months, and designate a data protection officer where the Act calls for one.
• Principles of data protection (Part IV): process lawfully, fairly and transparently, for explicit and legitimate purposes, collect only what is necessary, keep data accurate, retain it no longer than needed and transfer it out of Kenya only with adequate safeguards.
• Rights of data subjects (Part IV): inform people, give access, correct and delete where required, respect objections, restrictions and portability, and apply the limits on automated decisions, on consent and on processing data relating to children.
• Organisational duties (Part IV): carry out a data protection impact assessment where processing is likely to be high risk, build protection in by design or by default, and restrict commercial use of personal data.
• Breach notification (Part IV): a controller notifies the Data Commissioner within seventy-two hours of becoming aware of a breach and informs affected people within a reasonable time; a processor tells the controller within forty-eight hours.
• Sensitive personal data (Part V): process sensitive personal data, including health data, only on the permitted grounds.
• Transfer of personal data outside Kenya (Part VI): transfer only where the conditions are met, such as proof of appropriate safeguards or comparable protection in the receiving country, and follow any processing the Cabinet Secretary prescribes for servers or data centres in Kenya.

Compliance route

How do you comply with the Kenya Data Protection Act?

There is no certificate at the end of this route. Compliance is a position you maintain and must be able to demonstrate to the ODPC, to data subjects and to the customers who audit you. Sterling designs and builds the programme with your team; your organisation submits its own registration, and the ODPC alone regulates and enforces.

1. 01
   Establish your role and your registration position.Confirm the entities, whether each acts as controller, processor or both, whether a mandatory sector applies and what the ODPC data portal will ask for.
2. 02
   Gap analysis: compare current practice with the Act and regulations.Map processing activities, systems, suppliers and transfers, test notices, contracts and procedures against each duty, keep what works and agree actions and owners.
3. 03
   Register and implement.Your organisation files its registration on the information we help prepare; lawful bases, notices, request and breach procedures, impact assessments, processor agreements and transfer conditions go into use.
4. 04
   Audit, review and close the findings.An internal audit against the Act and a management review test what operates; we raise findings first and close them with evidence.
5. 05
   Keep it current.Renew registration before it lapses, screen new systems and suppliers, log requests and breaches, and answer customer audits and any ODPC enquiry from evidence that already exists.

Check the route before you sign. Registration is made by your organisation on the ODPC's own data portal, and the ODPC publishes its registration requirements; confirm them there rather than relying on a provider's summary. Treat any offer of a "Kenya data protection certificate" with caution: registration is not certification, and a seal from a private provider does not change your duties under the Act. The certification buyer's checklist

Cost

How much does Kenya Data Protection Act compliance cost?

The cost follows the amount of processing to map and the decisions still to be made. A single-entity service firm with a handful of systems is a different programme from a lender, hospital group or telecoms business with sensitive data, many suppliers and transfers abroad. Every component is shown in the proposal, under one all-inclusive proposal.

Timeline

How long does Kenya Data Protection Act compliance take?

Most programmes run for three to six months, as an estimate: shorter where registration is done and an information security system exists, longer where many systems, suppliers and transfers must be mapped and contracted. The pace is set by decisions on lawful bases, retention and transfers, and by controls operating long enough to leave evidence.

If a customer questionnaire or tender has a date, tell us at the start and we will say what is achievable by then.

Your engagement

What your Kenya Data Protection Act engagement includes

Your engagement follows the Sterling OS™ phases. Sterling does not certify, register or validate anything; we build the programme, and the ODPC regulates.

• Design™ or Drive™, your choice of support

  Design™ is guided: we lead the method and your people do the work. Drive™ is managed: our consultants carry the work with your sign-off. They are alternative levels of support, chosen at the start.

• Gap analysis and plan

  Processing, roles, registration position and transfers mapped, with actions, owners and dates agreed.

• Programme documents

  Notices, policies, request and breach procedures, impact assessment and processor agreement templates, written for your actual processing.

• Automate™ with Effivity

  Registers, requests, breaches and audits run in Effivity, included with the engagement at no additional cost.

• Training and internal audit

  Internal auditor training as applicable, preferential Sterling Academy access with complimentary awareness training, and an internal audit before anyone external looks.

• Sustain™ once the programme runs

  Renewal reminders, audits, regulatory watch and support when requests, breaches or ODPC enquiries arrive.

Registration, supervision and enforcement remain with the Office of the Data Protection Commissioner.

Often combined with

Standards organisations pair with Kenya Data Protection Act

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.