Kenya · Privacy & Data Protection
The country's own data-protection regime, registration duties, and its official supervisory authority.
AI-drafted, editorial review pending. The official links below are checked — confirm specifics with the authority.
The Data Protection Act 2019 applies to anyone processing personal data in Kenya or of people in Kenya and is enforced by the Office of the Data Protection Commissioner. Under section 18, data controllers and processors must register with the Commissioner, subject to thresholds set by regulation. Section 43 requires a controller to notify the Commissioner within 72 hours of becoming aware of a breach that carries a real risk of harm, and to tell the people affected. Data subjects can access, correct and object, and transfers abroad need appropriate safeguards. Under section 63 the Commissioner can impose penalties of up to KES 5 million or, for an undertaking, 1% of the previous year's turnover, whichever is lower.
- Controllers and processors register with the Data Protection Commissioner (s. 18).
- Breaches with a real risk of harm are notified within 72 hours (s. 43).
- Penalties: up to KES 5 million or 1% of turnover, whichever is lower (s. 63).
- Office of the Data Protection Commissioner (ODPC)
Office of the Data Protection Commissioner: registration, complaints and breach reports.
- Data Protection Act, 2019 (text)
Text of the Data Protection Act, 2019 (No. 24 of 2019), published by the ODPC.
Government portals
- Business Registration Service (BRS) — Company, LLP and business-name registration, official searches and insolvency.
- Kenya Revenue Authority (KRA) — Tax PINs, income tax, PAYE, VAT, eTIMS invoicing and customs.
- Directorate of Immigration Services — Work permits and passes, permanent residence, eTA and passports.
- Office of the Data Protection Commissioner (ODPC) — Registration of data controllers and processors, complaints and breach reports.