Skip to content
Emergency helpGet started
Compliance & Governance

Kenya Data Protection Act 2019: what it requires

Kenya's Data Protection Act 2019: who it applies to, ODPC registration, security measures, 72-hour breach notification and penalties.
By VigilbasePublished
Read the guideMore Topics

Kenya's Data Protection Act, 2019 (No. 24 of 2019) regulates the processing of personal data. It gives effect to the right to privacy in Article 31 of the Constitution, established the Office of the Data Protection Commissioner (ODPC), and sets duties for data controllers and data processors, including registration, security measures and breach notification within 72 hours. It was assented to on 8 November 2019 and commenced on 25 November 2019. This guide summarizes the Act and its 2021 registration regulations, and shows where security operations evidence helps.

Who does the Kenya Data Protection Act apply to?

Under section 4, the Act applies to the processing of personal data entered in a record, by automated or non-automated means, by a data controller or data processor that is established or ordinarily resident in Kenya and processes personal data while in Kenya. It also applies to a controller or processor that is not established or ordinarily resident in Kenya but processes the personal data of data subjects located in Kenya.

What are the principles of personal data protection?

Section 25 sets out the principles of data protection. Every data controller and data processor must ensure that personal data is:
1.Processed in accordance with the data subject's right to privacy.
2.Processed lawfully, fairly and in a transparent manner.
3.Collected for explicit, specified and legitimate purposes, and not further processed in an incompatible way.
4.Adequate, relevant and limited to what is necessary.
5.Accurate and, where necessary, kept up to date.
6.Collected only where a valid explanation is provided whenever information about family or private affairs is required.
7.Kept in a form that identifies data subjects for no longer than necessary.
8.Not transferred outside Kenya unless there is proof of adequate data protection safeguards or the data subject's consent.

Who must register with the Data Commissioner?

Section 18 says no person shall act as a data controller or data processor unless registered with the Data Commissioner, who sets the thresholds for mandatory registration. Under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, a certificate of registration is valid for 24 months.
1.A controller or processor with annual turnover or revenue below five million shillings and fewer than ten employees is exempt from mandatory registration, but must still comply with the Act's principles and obligations and its rules on transfers outside Kenya.
2.The exemption does not apply to processing for purposes listed in the regulations, which include the provision of financial services, health administration and patient care, educational institutions, telecommunications network or service providers, transport services and direct marketing.

What security measures does the Act require?

Section 41 requires every data controller and data processor to implement appropriate technical and organisational measures that put the data protection principles into effect and integrate the necessary safeguards into processing, both when the means of processing are decided and during processing. Section 42 adds that a controller using a processor must choose one that gives sufficient guarantees, under a written contract that binds the processor to act only on the controller's instructions. The measures the Act asks controllers and processors to consider are:
1.Identify reasonably foreseeable internal and external risks to personal data.
2.Establish and maintain appropriate safeguards against the risks identified.
3.Consider pseudonymisation and encryption of personal data.
4.Be able to restore the availability of and access to personal data in a timely manner after a physical or technical incident.
5.Verify that the safeguards are effectively implemented.
6.Continually update the safeguards in response to new risks or deficiencies.

When must a data breach be reported in Kenya?

Under section 43, where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the data subject, the data controller must notify the Data Commissioner without delay, within 72 hours of becoming aware of the breach. A later notification must give the reasons for the delay. The controller must also tell the data subject in writing within a reasonably practical period, unless their identity cannot be established. A data processor must notify the controller without delay and, where reasonably practicable, within 48 hours. The ODPC takes breach notifications through a form on its website.
1.The notification must describe the nature of the breach, the measures taken or intended, what the data subject should do, the unauthorised person if known, and a contact point.
2.Telling data subjects is not required where appropriate security safeguards, which may include encryption, have been implemented.
3.The controller must record the facts of the breach, its effects and the remedial action taken.

What are the penalties under the Kenya Data Protection Act?

Under section 63, the Data Commissioner can impose a penalty of up to five million shillings or, for an undertaking, up to 1% of its annual turnover in the preceding financial year, whichever is lower. Under section 73, an offence for which no specific penalty is provided carries a fine of up to three million shillings, imprisonment of up to ten years, or both. A person who suffers damage, including distress, because of a contravention is entitled to compensation from the data controller or data processor.

How Vigilbase supports Kenya Data Protection Act work

Vigilbase does not make an organization compliant with the Kenya Data Protection Act, and it does not replace your data protection officer. It helps you run some of the safeguards that section 41 describes, and produce evidence that they are monitored and verified. This guide summarizes the Act and its registration regulations. It is not legal advice: your legal advisers decide what the Act requires of your organization.
1.Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place, which helps you identify risks and verify that safeguards work.
2.The Vigil agent investigates high-severity incidents, and each investigation records the evidence, the actions taken and the verification result. That record helps you assemble the facts, effects and remedial action that section 43 asks you to record and report.
3.Managed Cloudflare runs WAF, DDoS, bot and DNS controls on the agreed scope, with configuration, change history and incident notes kept for review.
4.Default retention is set per dataset, typically 30 to 90 days. If you must keep records longer, decide where that archive lives before you consolidate.

Key Takeaways

✓The Data Protection Act, 2019 governs the processing of personal data in Kenya, and the Office of the Data Protection Commissioner (ODPC) regulates it.
✓Data controllers and processors must register with the Data Commissioner unless an exemption in the 2021 registration regulations applies.
✓Breaches with a real risk of harm must be notified to the Data Commissioner within 72 hours of becoming aware of them.
✓Section 41 requires appropriate technical and organisational measures that are verified and kept up to date.
✓Vigilbase helps you operate and evidence security safeguards; it does not certify compliance.

Sources

Related Solutions

Vigilbase services related to this guide

Managed SOC

Learn more

Managed Cloudflare

Learn more

Vigilbase OS

Learn more

Managed Cloudflare in Kenya

Learn more

Cloudflare Enterprise in Kenya

Learn more

Frequently Asked Questions

What is the Kenya Data Protection Act?

The Data Protection Act, 2019 (No. 24 of 2019) is Kenya's data protection law. It regulates the processing of personal data, gives data subjects rights, sets duties for data controllers and data processors, and established the Office of the Data Protection Commissioner.Privacy and data handling

Who enforces the Kenya Data Protection Act?

The Office of the Data Protection Commissioner (ODPC), which oversees the implementation of the Act and is responsible for its enforcement. It keeps the register of data controllers and data processors and investigates complaints, and the Data Commissioner can issue penalty notices.

Do we need to register with the ODPC?

Yes, unless an exemption applies. Controllers and processors with annual turnover or revenue below five million shillings and fewer than ten employees are exempt from mandatory registration, except when they process personal data for listed purposes such as financial services, health care, education or telecommunications.A certificate of registration is valid for 24 months. Exempt organizations must still comply with the Act's principles and obligations.

How quickly must a data breach be reported in Kenya?

Without delay, and within 72 hours of the data controller becoming aware of a breach that carries a real risk of harm to data subjects. A data processor must tell the controller without delay and, where reasonably practicable, within 48 hours.If the notification to the Data Commissioner is made after 72 hours, it must give the reasons for the delay.Security operations responsibilitiesWhat a SIEM does

What are the penalties under the Kenya Data Protection Act?

The Data Commissioner can impose a penalty of up to five million shillings or, for an undertaking, up to 1% of annual turnover in the preceding financial year, whichever is lower. Offences without a specific penalty carry a fine of up to three million shillings, imprisonment of up to ten years, or both.

Can Vigilbase make us compliant with the Kenya Data Protection Act?

No. Vigilbase helps you operate and evidence security safeguards: connected logs stay queryable, investigations record the evidence, actions and verification, and Managed Cloudflare keeps change history and incident notes. Your legal advisers decide what the Act requires of you.Get started with Vigilbase OSSecurity documentation in the Trust Center

Related Topics

Security Basics

What is SIEM?

Security Basics

What is SOC?

Network Security

What is WAF?

Compliance & Governance

POPIA compliance

Compliance & Governance

Nigeria Data Protection Act

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning