Kenya Data Protection Act: What Every Business Owner Must Know

The Kenya Data Protection Act came into force in 2025, and if you run a business in Kenya—whether you're collecting customer emails, storing M-Pesa transaction records, or managing employee data—you are now legally required to comply with it. This isn't optional. Penalties for non-compliance range from significant fines to criminal prosecution.

The Act established the Office of the Data Protection Commissioner, a new regulator tasked with enforcement. The Commissioner's office has already begun investigating complaints and auditing businesses. Ignorance of the law will not protect you.

What the Act Actually Covers

The Kenya Data Protection Act applies to any organisation—private, public, or non-profit—that processes personal data. Personal data is broadly defined: names, email addresses, phone numbers, ID numbers, financial information, health records, even IP addresses and cookies on your website.

The trigger is processing. If you collect it, store it, use it, or share it, you're processing it. An e-commerce business storing customer addresses. A salon keeping phone numbers for appointments. A tech startup logging user behaviour. All covered.

The Act has teeth in two directions. First, your business must follow strict rules about how you handle data. Second, individuals whose data you hold have new rights—they can demand to see what you've collected, request deletion, and withdraw consent.

The Core Requirements You Cannot Ignore

You must have a clear lawful basis for collecting data. The Act lists six: consent, contract, legal obligation, vital interests, public task, or legitimate interests. For most businesses, consent is the safest route. On your website, your app, your forms—you need explicit, informed consent before collecting information.

Data must be kept secure. This means encrypted storage, restricted access, regular backups, and a written incident response plan. If you store data on a spreadsheet shared across your team with no password protection, you're violating the Act. If a breach happens and you don't notify affected individuals and the Commissioner within 72 hours, you face additional penalties.

You must appoint a Data Protection Officer (DPO) if you're a large organisation or handle sensitive data regularly. Even small businesses should at least designate someone responsible for compliance. Compliance experts on Kaziiko can help you assess whether you need a formal DPO role.

Create a data inventory. Document what data you collect, where it comes from, how long you keep it, and who has access. This isn't bureaucracy for its own sake—it's your audit trail if the Commissioner asks questions.

Practical Steps to Start Today

Audit your current data. Walk through your business: what customer information do you have? Where is it stored? Who can access it? Write this down.

Review your privacy policy. If you don't have one, write one. If you do, update it to reflect the Act's requirements. Be transparent about what data you collect and why.

Update your consent mechanisms. Add checkboxes to your website signup forms. Make consent opt-in, not opt-out. Train staff on data handling.

Document your processes. How do you handle data requests? What's your incident response plan? When will you delete old data?

If this feels overwhelming, find a verified Kenyan expert on Kaziiko who specialises in data protection compliance. Many small businesses benefit from a one-time audit and guidance rather than trying to navigate this alone.

Frequently Asked Questions

Do I need a Data Protection Officer?

Large organisations and those processing sensitive data regularly must appoint a DPO. Smaller businesses may not be legally required, but designating someone responsible for compliance is best practice. Check with the Office of the Data Protection Commissioner for your specific situation.

What happens if I don't comply?

Fines start at 5 million Kenyan shillings and can reach 10 million for serious violations. The Commissioner can also issue compliance orders, ban certain processing activities, or refer cases for criminal prosecution. Individuals harmed by violations can sue for damages.

How do I notify people of a data breach?

You have 72 hours to inform affected individuals and the Data Protection Commissioner. Use email, SMS, or your website—whatever reaches them fastest. Explain what happened, what data was affected, and what steps you're taking to fix it.

Can I store data in the cloud?

Yes, but the cloud provider must be trustworthy and contractually bound to protect data. If your provider has a breach, you're still liable. Ensure your cloud contract includes data protection terms compliant with the Act.