Consent
Consent must be informed, specific, and freely given, allowing individuals to withdraw it anytime.
DPO360 helps with
Policy architecture and records of processing
Data protection in Kenya.
The Data Protection Act No. 24 of 2019 (the Act) was signed into law and came into effect in November 2019, and sets out the regulatory framework for data protection in Kenya. It sets out guidelines on how personally identifiable data can be used, stored, or shared.
- In force
- November 2019
- Regulator
- ODPC
- Maximum fine
- KES 5M or 1% of turnover
KisumuNairobi, HQMombasa
At a glance
Kenya, in seven lines.
- Law
- Data Protection Act, 2019 (No. 24 of 2019)
- In force
- November 2019
- Regulator
- Office of the Data Protection Commissioner (ODPC)
- Registration
- Mandatory above thresholds in the 2021 Registration Regulations, and in certain sectors regardless of size
- Data protection officer
- May be designated (section 24); relevant for public bodies, large-scale monitoring and sensitive data
- Breach notification
- Within 72 hours of becoming aware, to the ODPC; data subjects within a reasonably practical period where there is a risk of harm
- Maximum fines
- Up to KES 5 million or 1% of annual turnover, whichever is lower (section 63)
A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.
Key obligations
What the law asks of you.
Four obligations organisations in Kenya meet first, and where we help with each.
Breach notification
Notify the Office of the Data Protection Commissioner and affected individuals promptly in the event of a data breach.
DPO360 helps with
Incident and breach logging, escalation and regulator notification
Civil registration regulations
Process personal data in civil registries to align with data protection principles.
DPO360 helps with
Regulatory correspondence and audit reporting
Local processing
Certain data must be processed on servers located in Kenya, as per regulations.
DPO360 helps with
Data mapping across systems, vendors and cross-border flows
How the framework came together
From the Act to the regulations.
November 2019
The Act comes into effect
The Data Protection Act No. 24 of 2019 is signed into law and sets out the regulatory framework for data protection in Kenya.
2021
Regulations are gazetted
The Civil Registration Regulations and three sets of data protection regulations have since been gazetted.
Today
The ODPC enforces
The Act establishes the Office of the Data Protection Commissioner to ensure enforcement.
Regulations gazetted
- The Civil Registration Regulations
- The Data Protection (General) Regulations, 2021
- The Data Protection (Complaints Handling and Enforcement Procedures) Regulations, 2021
- The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021
ODPCRegulatory authority
Office of the Data Protection Commissioner (ODPC)
The designated government agency that is key to ensuring appropriate handling of personal data in Kenya, as enshrined in the Data Protection Act (DPA) of 2019.
Ms. Immaculate Kassait, Data Commissioner
Visit the websiteWhat the ODPC does
Registers controllers and processors
Data controllers and processors register with the ODPC.
Handles complaints
Under the Complaints Handling and Enforcement Procedures Regulations, 2021.
Enforces the Act
The Act establishes the ODPC to ensure enforcement.
Penalties
What non-compliance can cost.
Administrative fines
KES 5M
or 1% of annual turnover, whichever is lower
The Data Commissioner can impose a penalty of up to KES 5 million or, for an undertaking, up to 1% of annual turnover of the preceding financial year, whichever is lower (section 63).
Criminal offences
10 yrs
up to, with a fine of up to KES 3 million
A person who commits an offence under the Act with no specific penalty can face a fine of up to KES 3 million or imprisonment of up to 10 years, or both (section 73).
A pending Amendment Bill proposes changing "whichever is lower" to "whichever is higher". Please check its current status.
Readiness check
Where do you stand?
Tick what is already in place. A quick read on where you stand in Kenya, for orientation only.
0/6
Plenty to tighten.
A short scoping call will map the gaps and the order to close them.
Compare
Eight countries at a glance.
Tap a country to highlight its column. Scroll sideways for the rest.
A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.
Reviewed October 2026 against: Data Protection Act, 2019 (sections 18, 24, 43, 63 and 73) and the Data Protection (General, Registration and Complaints) Regulations, 2021.
Additional resources
Read the source documents.
Headquarters, Nairobi
DPO360 in Kenya
Your Kenya team, in Nairobi.
Our headquarters are in Nairobi, so support for organisations in Kenya is local, close to the regulator and close to you.
- Registration and licensing filings with the ODPC
- Breach logging, escalation and notification support
- Consent, policy and records-of-processing frameworks
- Data mapping, including where data is processed
- Data subject access request management
- A standing DPO appointment, with DPO-as-a-Service
2nd Floor 90 JGO, James Gichuru Road, Lavington
P.O Box 40583-00100 Nairobi, Kenya
+254735360360 | +447394407463
Ready to Make Privacy Your Advantage?
Speak to our team about compliance in Kenya and beyond.