Kenya’s Data Protection Act 2019 came into force in November 2019, establishing a comprehensive legal framework for the protection of personal data. The Act applies to any organisation — domestic or foreign — that processes the personal data of individuals located in Kenya.
Key Obligations
Organisations must register with the Office of the Data Protection Commissioner (ODPC), implement appropriate technical and organisational security measures, appoint a Data Protection Officer where required, and honour data subjects’ rights including the right of access, correction, and erasure.
Penalties
Violations can attract fines of up to KES 5 million or imprisonment. Contact our IP and data protection team for a compliance audit.
