Kenya's Data Protection Act, 2019 established the country's first comprehensive data protection regime, and — like Nigeria's NDPA and South Africa's POPIA — it draws heavily on GDPR-style principles while remaining its own distinct national law with its own regulator, thresholds, and enforcement mechanics.
The Office of the Data Protection Commissioner (ODPC)
The Act established the Office of the Data Protection Commissioner as Kenya's dedicated regulator, responsible for registration, guidance, complaint handling, and enforcement — following the same "one national regulator" model used by South Africa's Information Regulator and Nigeria's NDPC, rather than a distributed multi-authority model like the EU's.
Registration of data controllers and processors
Kenya's regime includes a registration requirement for data controllers and processors — generally tied to factors like the volume of data processed, the nature of the data (including whether it's sensitive personal data), and annual turnover, rather than applying identically to every business regardless of scale. Confirming whether your specific organisation meets the current registration thresholds is a genuine first compliance step, not a formality to skip.
Data Protection Officer: threshold-based, not universal
Kenya's DPA takes a threshold-based approach to appointing a Data Protection Officer, closer to GDPR's model than POPIA's — a DPO is generally required for public bodies and for organisations whose core activities involve processing that requires regular, systematic monitoring of data subjects at scale, or processing special categories of sensitive personal data as a core activity, rather than being mandatory for every organisation regardless of size the way POPIA's Information Officer requirement is.
Lawful processing and data subject rights
Processing generally requires a lawful basis — commonly consent, or necessity for a contract, legal obligation, protecting vital interests, or a legitimate interest — and data subjects are given rights that will feel familiar from GDPR: the right to be informed of how their data is used, the right to access their own personal data, the right to correction and deletion, and the right to object to processing, including for direct marketing purposes.
Cross-border transfer restrictions
Transferring personal data outside Kenya is restricted unless the recipient jurisdiction or organisation provides an adequate level of data protection, or appropriate safeguards (such as contractual protections) are in place — the same general adequacy-based logic used by GDPR, POPIA, and Nigeria's NDPA, though Kenya's own criteria for what counts as "adequate" are set out in the Act and its regulations rather than automatically mirroring another jurisdiction's standard.
Breach notification
The Act requires notifying the Data Protection Commissioner of a security breach affecting personal data, and notifying affected data subjects where the breach is likely to result in a risk to their rights and freedoms — following the now-familiar regional pattern of regulator notification plus individual notification for higher-risk breaches.
Enforcement
The ODPC has enforcement powers including investigating complaints, issuing compliance and enforcement notices, and imposing administrative penalties for non-compliance. Because penalty structures and thresholds are set out in the Act's regulations and can be updated, the specific current figures are worth confirming directly against ODPC guidance rather than a secondary summary.
This guide is general information, not legal advice — specific obligations depend on your processing activities, scale, and current ODPC guidance. Consult a qualified professional for advice specific to your organisation.
One more African data protection regime to track alongside the others
For businesses operating across Kenya, Nigeria, and South Africa, the compliance foundations overlap substantially — a real data inventory, documented lawful bases, security safeguards, and breach response procedures satisfy most of all three regimes at once. ComplianceDesk lets you activate Kenya's Data Protection Act alongside POPIA and Nigeria's NDPA as separate frameworks while sharing evidence across their overlapping controls.