Kenya Data Protection Act
In force Kenya · In force Nov 25, 2019 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Kenya's GDPR-inspired data protection law establishing the ODPC, mandatory registration of data controllers and processors, data subject rights, 72-hour breach notification to the Commissioner, DPIAs, and conditions on cross-border transfers (with some data localisation for strategic public interest processing).
- Who it applies to
- Controllers and processors established or resident in Kenya, or processing personal data of data subjects located in Kenya. Registration required unless exempt under the Registration Regulations (e.g. small entities below turnover/employee thresholds, except sectors listed as mandatory).
- Penalties
- Administrative fines up to KES 5 million or 1% of annual turnover of the preceding financial year, whichever is lower; criminal offences with fines and imprisonment.
- Enforced by
- Office of the Data Protection Commissioner (ODPC)
- Official name
- Data Protection Act, 2019 (No. 24 of 2019)
- Citation
- Act No. 24 of 2019
- Topics
- privacy, breach-notification, data-residency
Verified 2026-09-22 new.kenyalaw.org
Research notes
Data Protection (General), (Registration) and (Complaints Handling) Regulations 2021 followed; the registration compliance date (reported as July 2022) was not verified so is omitted. Assent date 8 Nov 2019 from recollection.
Related
Israel Privacy Protection Law Amendment 13
Nigeria NDPA
Saudi PDPL
South Africa POPIA
UAE PDPLQuestions about Kenya Data Protection Act
- What are the Kenya Data Protection Act compliance deadlines?
- Nov 25, 2019: Data Protection Act in force.
- When does Kenya Data Protection Act take effect?
- Kenya Data Protection Act took effect on Nov 25, 2019.
- Who does Kenya Data Protection Act apply to?
- Controllers and processors established or resident in Kenya, or processing personal data of data subjects located in Kenya. Registration required unless exempt under the Registration Regulations (e.g. small entities below turnover/employee thresholds, except sectors listed as mandatory).
- What are the penalties under Kenya Data Protection Act?
- Administrative fines up to KES 5 million or 1% of annual turnover of the preceding financial year, whichever is lower; criminal offences with fines and imprisonment.