Understanding Data Protection Obligations in Kenya

The Data Protection Act, 2019 established Kenya's first comprehensive framework for the protection of personal data. Organisations that collect, process, or store personal data of Kenyan residents must register with the Office of the Data Protection Commissioner and implement appropriate technical and organisational measures.

Key obligations include appointing a Data Protection Officer where required, conducting Data Protection Impact Assessments for high-risk processing, and ensuring cross-border data transfers comply with adequacy requirements.

Non-compliance can attract significant penalties. Our team advises clients across sectors — from telecommunications to financial services — on building robust compliance programmes.