Lumumba Lena Owano
Kenya's Data Protection Act, 2019 has moved firmly from paper to practice. The Office of the Data Protection Commissioner (ODPC) has registered thousands of organisations, issued penalty notices against companies, and, by early 2026, issued 184 compensation orders to individuals whose data was mishandled. For any business that collects customer, employee or supplier information, compliance is no longer optional.
Who the Act applies to
The Act regulates the processing of personal data by data controllers (who decide why and how data is processed) and data processors (who process data on a controller's behalf). It covers organisations established in Kenya and those outside Kenya that process the personal data of people in Kenya.
Registration with the Data Commissioner
Controllers and processors must register with the ODPC unless an exemption under the registration regulations applies. Continuing to process personal data without registration, or failing to renew an expired certificate, is an offence. Businesses should confirm their status rather than assume an exemption applies.
Breach notification within 72 hours
Where a personal data breach creates a real risk of harm, the controller must notify the Data Commissioner without delay and within seventy-two hours of becoming aware of it, and must also inform affected individuals. Having an incident response plan in place before a breach occurs is the only realistic way to meet that deadline.
The cost of getting it wrong
The ODPC has issued administrative penalties of up to KES 5 million against data controllers, alongside enforcement notices and compensation orders in favour of complainants. Beyond the fines, enforcement action carries a reputational cost that is often greater.
A practical compliance checklist
As a minimum, every organisation should:
- Map what personal data it holds, where it comes from and who it is shared with
- Confirm its registration status with the ODPC
- Identify a lawful basis for each processing activity, including valid consent where required
- Update privacy notices, employee policies and supplier contracts
- Put a written breach response procedure in place and train staff on it
- Carry out data protection impact assessments for high-risk processing
We advise businesses on registration, compliance programmes, contracts with processors and responses to ODPC complaints and enforcement action.
Sources
This article is general information on Kenyan law as at its publication date and is not legal advice.
