Data & Privacy · Kenya
Data protection & privacy law in Kenya (2026)
Kenya shaded by its data & privacy status
Data protection in Kenya: comprehensive law.
FrameworkData Protection Act, No. 24 of 2019, supervised by the Office of the Data Protection Commissioner (ODPC); supplemented by the Data Protection (General) Regulations, 2021, Registration of Data Controllers & Processors Regulations, 2021, and Complaints Handling & Enforcement Procedure Regulations, 2021.
Kenya has a comprehensive, GDPR-style personal-data protection regime: the Data Protection Act, 2019 (assented 8 Nov 2019; commenced 25 Nov 2019) establishes an independent Office of the Data Protection Commissioner (ODPC), codifies lawful-basis rules, data-subject rights, mandatory registration, and cross-border transfer conditions. Enforcement has shifted from awareness-building to active supervision in 2025–2026, with hundreds of compensation orders, enforcement notices, and penalty notices issued, and a Data Protection (Amendment) Bill 2025 proposing new AI, cross-border, and penalty provisions.
Key points
The Data Protection Act, 2019 is in force and gives effect to Article 31(c)(d) of the Constitution. It establishes the ODPC as an independent state office under the Ministry of Information, Communications and the Digital Economy, with powers to register, investigate, audit, order compensation, and impose penalties.
No person may act as a data controller or data processor without being registered with the Data Commissioner. Entities with turnover above KES 5 million or more than 10 employees must register; prescribed sectors (financial services, health, telecoms, education, etc.) must register regardless of size.
The Act codifies principles of lawfulness, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability, and grants rights of information, access, objection, rectification, erasure, data portability and protection against automated decisions. Controllers must undertake DPIAs and notify breaches to the ODPC within 72 hours.
Section 48 permits transfers abroad only where the Data Commissioner is satisfied of appropriate safeguards (adequacy, binding corporate rules, standard contractual clauses) or where a statutory ground (consent, contract, vital/public interest) applies. Sensitive personal data and certain strategic-interest data must have at least one serving copy stored on a server or data centre in Kenya.
The ODPC may issue administrative penalties of up to KES 5 million or 1% of annual turnover (whichever is lower); criminal offences can attract fines of KES 3 million and/or imprisonment of up to 10 years. By 2026 the ODPC had received more than 9,000 complaints and issued 184 compensation orders, 134 enforcement notices and 20 penalty notices, with active audits of banks, microfinance institutions and digital lenders.
A Data Protection (Amendment) Bill, 2025 is before Parliament proposing new obligations around artificial intelligence, cross-border data sharing, and higher penalties; draft Conduct of Compliance Audit Regulations give the ODPC a formal framework for on-site and desk audits. These are proposals/sub-legislation layered on the comprehensive Act already in force.
Timeline - major decisions & events
The Office of the Data Protection Commissioner issued an official notice confirming that Worldcoin/Tools for Humanity had permanently deleted all biometric (iris) data collected from Kenyans, closing out the long-running enforcement saga.
Business Daily ↗The High Court ruled that Worldcoin's iris-scanning in Kenya breached the Data Protection Act 2019, collecting sensitive data without a Data Protection Impact Assessment or valid informed consent, and ordered permanent deletion within seven days under ODPC supervision.
Techpoint Africa ↗The ODPC fined digital lender Whitepath for listing an individual as a guarantor without consent and subjecting them to debt-collection calls, its second sanction against the lender, reinforcing scrutiny of the mobile-lending sector.
TechCabal ↗The ODPC fined Zuku Fibre's parent for continuing to send unsolicited marketing messages to a former customer who had terminated service and repeatedly requested data deletion, affirming the right to erasure and to object to direct marketing.
The Lawyer Africa ↗In a precedent-setting move, the ODPC fined Mulla Pride (KES 2.975M), Roma School (KES 4.55M) and Casa Vera Lounge (KES 1.85M) for unlawful debt-collection messaging and posting individuals'/minors' photos without consent, its first substantive penalty determinations.
ODPC ↗The Ministry of Interior suspended Worldcoin's public iris-scanning operations over concerns about consent, data security and lack of safeguards for biometric data, triggering a formal ODPC data-protection investigation.
Africanews ↗The Data Commissioner fined OPPO Kenya KES 5 million for failing to comply with an enforcement notice after posting an individual's image without consent, the regulator's debut use of its penalty powers.
ODPC ↗Legal Notices 263-265 of 2021 operationalised the Act, the General, Registration, and Complaints Handling & Enforcement Regulations, detailing data-subject rights, cross-border transfers, breach notification, mandatory registration thresholds and complaint procedures (commenced 14 January 2022).
Kenya Law ↗In Katiba Institute v Attorney General, the High Court declared rollout of the Huduma card illegal absent a Data Protection Impact Assessment, applying the Act retrospectively and setting a landmark precedent that state ID systems must comply with data-protection law.
Privacy International ↗Immaculate Kassait was sworn in as Kenya's inaugural Data Commissioner (single six-year term), operationalising the Office of the Data Protection Commissioner and giving the 2019 Act an enforcement body.
IAPP ↗Kenya's comprehensive, GDPR-aligned data-protection statute (Act No. 24 of 2019) took effect, giving effect to Article 31(c)(d) of the Constitution, establishing the ODPC and setting out lawful-processing principles, data-subject rights and cross-border transfer rules.
Kenya Law ↗Article 31 of the 2010 Constitution guaranteed every person the right not to have information relating to their private affairs unnecessarily required or revealed and to keep communications private, the constitutional foundation for all subsequent data-protection law.
Kenya Law Reform Commission ↗Kenya - other topics
Data & Privacy in other countries
Last verified 10/15/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →