Kenya · Compliance
Kenya Data Protection Act, 2019 compliance in Kenya
Achieve Kenya Data Protection Act, 2019 compliance with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Nairobi office team
- Effivity software included
- Academy training included
Who asks for Kenya Data Protection Act, 2019 in Kenya
Clients include
Kenya Data Protection Act, 2019 compliance in Kenya at a glance
Data Protection Act, 2019 (Act No. 24 of 2019) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Kenya ask for evidence that you meet it.
Registration with the Office of the Data Protection Commissioner is where most Kenyan privacy programmes begin. The Data Protection Act, 2019 says no one may act as a controller or processor unless registered, and the ODPC lists purposes, from health and education to telecoms and direct marketing, where smaller organisations are not exempt. The Act then sets principles, data subject rights, impact assessments for high-risk processing, privacy by design, breach notification and conditions for sending data abroad, and regulation 26 of the 2021 General Regulations keeps processing for listed strategic purposes inside Kenya. No certificate proves compliance: evidence is registration, records, notices, contracts and security measures, and ISO/IEC 27701 certification by an accredited body is an optional extra. Sterling's Nairobi office runs the work with clear owners for each obligation, using Effivity to keep evidence current and drawing on 20+ years of practice.
Who needs Kenya Data Protection Act, 2019 in Kenya, and what happens without it
These are the organisations in Kenya that most often need to show Kenya Data Protection Act, 2019.
- Any business that decides how personal data is usedThe Act applies to controllers and processors established in Kenya and to those outside Kenya who process personal data of people located in Kenya.
- Banks, insurers, telecoms, health, education and hospitality providersThe ODPC lists these among purposes for which registration is not waived, whatever the size of the organisation.
- Cloud, CRM and outsourcing providers acting as processorsThe Act and the General Regulations require a written contract under which a processor acts only on the controller's instructions.
- Operators of civil registration, elections, public finance, protected systems, basic education and health care systemsRegulation 26 of the General Regulations requires such processing to run through a server and data centre in Kenya or keep a serving copy there.
- Digital lenders, marketers and CCTV operatorsThe ODPC publishes specific guidance notes and the regulations restrict commercial use of personal data and require opt-out mechanisms for direct marketing.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkKenya Data Protection Act, 2019 requirements in Kenya
Strip away the vocabulary and Kenya's Data Protection Act requires a business to comply in six areas of personal data handling.
In Kenya these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Kenya Data Protection Act, 2019 explained →
How to achieve Kenya Data Protection Act, 2019 compliance in Kenya
One team from the Nairobi office carries the work from scoping to sign-off. Clients across Kenya are served from Sterling's Nairobi office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Kenya Data Protection Act, 2019 and the Kenyan requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Kenya Data Protection Act, 2019 compliance take in Kenya?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Kenya these are the factors that set the timeline.
- Number of processing activities, systems and processors to map
- Registration status and whether processing falls within a listed purpose
- Cross-border transfers and any processing that must stay in Kenya
- Security remediation and breach procedure readiness
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Kenya Data Protection Act, 2019 compliance cost in Kenya?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Kenya these factors move both.
- Number of legal entities and business units in scope
- Volume and sensitivity of personal data, including health and biometric data
- Processor contract review and impact assessments
- Security control remediation
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Kenya Data Protection Act, 2019 consultants and assessors in Kenya
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Kenya Data Protection Act, 2019 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Kenya are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Kenya Data Protection Act, 2019 in Kenya (5)
| Instrument | How it treats the standard |
|---|---|
| Data Protection Act, 2019 (Act No. 24 of 2019) | The instrument itself Registration with the Data Commissioner, principles, data subject rights, data protection impact assessment, data protection by design and by default, breach notification and conditions for transfers out of Kenya. |
| Data Protection (General) Regulations, 2021 (Legal Notice No. 263) | Regulations Consent, direct marketing opt-outs, retention, data protection policy, controller and processor contracts, breach notification and regulation 26 on processing within Kenya for listed strategic purposes. |
| Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 | Regulations Registration with the ODPC; the ODPC states that smaller organisations are exempt unless they process data for listed purposes, and that registration opened on 14 July 2022. |
| Data Protection (Complaints Handling and Enforcement) Regulations, 2021 | Regulations How complaints to the Data Commissioner are received, investigated and enforced; listed with the Act on the ODPC's regulatory framework page. |
| ODPC guidance notes | Guidance Notes on impact assessment, consent, data protection policies, biometric, children's and health data, digital credit providers, education and communication sectors and a Data Sharing Code. |
Accreditation, audit language and remote audits in Kenya
Compliance, not certification: the Data Protection Act, 2019 has no certificate that proves compliance. Evidence is registration with the ODPC, records of processing, privacy notices, controller and processor contracts, impact assessments, security measures and a working breach procedure. The Act lets the Commissioner offer certification standards, seals and marks, and says that a certification issued under it does not alter the controller's or processor's responsibility. ISO/IEC 27701 certification by an accredited body is an optional way to evidence a privacy management system. Edition and transition details: Kenya Data Protection Act, 2019 hub →
Audit language
Privacy notices and consent requests should be in a language the audience understands; internal records are usually kept in English, and Kiswahili is the national language.
Remote and on-site
Data mapping and privacy workshops can be on-site or remote; the Act prescribes no external assessment, although the Commissioner may audit and investigate complaints.
Kenya Data Protection Act, 2019 in Kenya: questions clients ask
Must a Kenyan business register with the Data Protection Commissioner?
Generally yes. Section 18 provides that no person may act as a controller or processor unless registered with the Data Commissioner, who sets the thresholds. The ODPC says smaller organisations below its thresholds are exempt unless they process data for listed purposes. Test your own case against the ODPC's current guidance with your counsel.
Is there a certificate that proves compliance with the Kenya Data Protection Act?
No. Compliance is shown through evidence: registration, records of processing, notices, contracts, impact assessments and security measures. The Act lets the Commissioner offer certification standards, seals and marks, but says such certification leaves your responsibility unchanged. ISO/IEC 27701 from an accredited body is optional supporting evidence. Ask the ODPC about any scheme it currently offers.
Which processing in Kenya must stay in the country?
The General Regulations require processing for listed strategic purposes to use a server and data centre in Kenya, or to keep at least one serving copy there. The list covers civil registration and legal identity, elections, public finance systems, protected computer systems, basic education and primary or secondary health care. Check whether your service is caught with your counsel or the ODPC.
Can an organisation use automated decisions about people in Kenya?
With limits. The Act gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that has legal effects or significantly affects them, subject to exceptions such as contract, authorising law or consent, and a duty to notify the person in writing. Test your use case with your counsel or the ODPC.
More on Kenya Data Protection Act, 2019 for Kenyan organisations
Other standards Kenyan businesses ask Sterling for
Organisations in Kenya often combine Kenya Data Protection Act, 2019 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Nairobi office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act, 2019 (Act No. 24 of 2019) — odpc.go.ke (accessed 11 Oct 2026)
- Data Protection (General) Regulations, 2021 (Legal Notice No. 263) — odpc.go.ke (accessed 11 Oct 2026)
- Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 — odpc.go.ke (accessed 11 Oct 2026)
- Data Protection (Complaints Handling and Enforcement) Regulations, 2021 — odpc.go.ke (accessed 11 Oct 2026)
- ODPC guidance notes — odpc.go.ke (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Nairobi team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Nairobi office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice