Kenya. Comprehensive data protection. Act
Kenya DPAData Protection Act, 2019 (No. 24 of 2019)
§1Summary
- Synopsis
Kenya's comprehensive data protection law, closely modelled on the GDPR, establishing the ODPC and regulating controllers and processors established in or processing data of persons in Kenya. Detailed rules on registration, rights, transfers and enforcement sit in the 2021 regulations.
- Key themes
- Unique features
Mandatory registration with the ODPC for controllers and processors (exemption for entities under KES 5m turnover and fewer than 10 staff, unless in listed sectors). The General Regulations require processing for 'strategic interest of the State' to be done through a server or data centre located in Kenya, or with at least a serving copy held in Kenya.
- SaaS relevance
Applies to controllers/processors outside Kenya processing personal data of data subjects located in Kenya, and SaaS vendors in mandatory sectors (e.g. financial services, health, education, telecoms) must register regardless of size.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- ODPC within 72h where real risk of harm; processors to controller within 48h; data subjects without undue delay
- DPO
- No
- Cross-border transfers
- Appropriate safeguards, adequacy, necessity, consent (sensitive data)
- Maximum penalty
- KES 5m or 1% of prior-year turnover, whichever is lower; criminal fines up to KES 3m and/or 10 years
§3Dates
- Key dates
- Adopted
- In force
- ODPC established 2020; General, Registration and Complaints Handling Regulations 2021 in force 2022-01-14 (registration deadline 2022-07-14)
§4Text and authority
- Text
- Authoritative text odpc.go.ke
- Authority
- Office of the Data Protection Commissioner (ODPC)
§5Where it applies
- Domestic law of
- Kenya
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Kenya reported as under EU adequacy review (2025); not adopted. Localisation description of reg 26 not verified against regulation text this session.