Data Protection Act
Data Protection Act, 2019 (No. 24 of 2019)
Kenya's Data Protection Act 2019 commenced on 25 November 2019 and established the Office of the Data Protection Commissioner. It requires many controllers and processors to register, treats biometric data as sensitive, and has been actively enforced, including penalty notices against digital lenders and device makers.
Who it applies to
Data controllers and processors established or resident in Kenya, and those outside Kenya processing personal data of data subjects located in Kenya. Registration with the ODPC is mandatory above turnover and staff thresholds set in the 2021 registration regulations and for listed sectors regardless of size.
Identity requirements
- Process sensitive personal data, including biometric data, only under the additional conditions the Act sets
- Obtain consent from a parent or guardian before processing children's data, using appropriate age verification
- Conduct a data protection impact assessment where processing is likely to result in high risk
- Notify the Data Commissioner within 72 hours of becoming aware of a breach, and notify affected data subjects where there is a real risk of harm
- Transfer personal data outside Kenya only with proof of appropriate safeguards, and process certain strategic data only in Kenya where required
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Identity verification (KYC/proofing) | Biometric eKYC against the national ID (including Maisha Namba) is sensitive-data processing. |
| Breach notification | A 72-hour notification duty applies to the Data Commissioner. |
| Data residency & cross-border transfer | Cross-border transfers need documented safeguards, and some processing must stay in Kenya. |
| Customer identity & consent (CIAM) | Parental consent and age verification are required for children's data. |
Penalties
The Data Commissioner may issue penalty notices of up to 5 million Kenyan shillings or, for an undertaking, up to 1 percent of its annual turnover in the preceding financial year, whichever is lower.
Status and dates last verified against primary sources on 2026-10-31.
Data Protection Act: frequently asked questions
- Do companies have to register with the ODPC?
- Many do. The Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021 require registration above turnover and staff thresholds, and for listed sectors such as health, education and financial services regardless of size.
- How fast must breaches be reported in Kenya?
- Within 72 hours of the controller becoming aware of the breach, to the Data Commissioner.