Privacy Map

Kenya. Comprehensive data protection. Regulation

Kenya DP Regulations 2021Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 and Data Protection (General) Regulations, 2021

In force

§1Summary

Synopsis

Implementing regulations that operationalise registration, rights handling, breach reporting, transfers and localisation under the Kenya DPA. They set registration tiers, fees and the list of sectors that must register irrespective of size.

Key themes
  • registration fees
  • mandatory sectors
  • data subject requests
  • breach notification
  • transfer safeguards
  • local processing for strategic interest
Unique features

Registration fees by size: micro/small KES 4,000 (renewal 2,000), medium KES 16,000 (9,000), large KES 40,000 (25,000); certificates valid two years. Mandatory registration for sectors including education, health, financial services, telecoms, hospitality, transport, property management, direct marketing and genetic data processing.

SaaS relevance

Determines whether a SaaS provider with Kenyan customers must register and which fee tier applies; telecom, fintech and health-tech SaaS fall into mandatory sectors.

§2Obligations

Extraterritorial
Yes
Breach notification
As DPA: ODPC within 72h
DPO
No
Cross-border transfers
Appropriate safeguards/BCRs, adequacy, necessity, consent
Maximum penalty
As DPA; daily fine up to KES 10,000 until rectified

§3Dates

Key dates
  • Adopted
  • In force
  • Gazetted end-2021 with Complaints Handling Procedure and Enforcement Regulations; 6-month registration grace to 2022-07-14

§4Text and authority

Text
Authority
Office of the Data Protection Commissioner (ODPC)

§5Where it applies

Domestic law of
Kenya

§6Sources and verification

Sources consulted
Verification

High confidence.

ODPC guidance inconsistent on '10 employees' exemption wording.