Kenya Data Protection Act 2019: ODPC Compliance Guide

The Registration Regulations 2021 set thresholds (annual turnover/revenue above KES 5 million or more than 10 employees) above which controllers and processors must register, and list sectors where registration is mandatory regardless of size: among them financial institutions and digital lenders, telecoms, health providers, education institutions, betting firms, property agents, and CCTV operators. Registration describes processing purposes, categories, transfers, and safeguards; certificates last 24 months and renewals are checked. Operating unregistered where registration is required is an offense, and the ODPC publishes the register, making gaps publicly verifiable.

GDPR-family rights: information, access, correction, deletion, objection (including to direct marketing and profiling), portability, and rights around automated decisions. The General Regulations set procedures and timelines, requests are generally handled within reasonable statutory periods with the regulations specifying response expectations, and complaints to the ODPC are free and actively processed (the Complaints Regulations govern the pipeline: admission, investigation, determination, with appeals to the High Court). Kenyan practice is notably complaint-driven: individuals use the ODPC readily, and photo/marketing consent complaints have produced repeated penalties.

A busy docket by regional standards. Landmarks: the maximum KES 5 million penalty against a digital credit provider (Whitepath) over unconsented contact-list processing, KES 4.55 million against Mulla Pride (another lender) for using borrowers' contacts to shame-debt-collect, penalties against a school and a restaurant/club chain (Casa Vera) for publishing individuals' images without consent, and enforcement notices across education, hospitality, and real estate. Themes: consent for photos and marketing, digital-lending abuses, and CCTV. The ODPC also audits registration status and has ordered compensation to complainants, a remedial power GDPR authorities lack.

Section 48 permits transfers out of Kenya only where the controller provides proof to the ODPC of appropriate safeguards for the data's security and protection (including that the destination has commensurate protection), or with the data subject's consent, or on necessity grounds (contract, legal claims, vital interests, public interest). Sensitive data transfers face additional conditions under Section 49 and the regulations, effectively consent-or-necessity with safeguards. There is no published adequacy whitelist; the operational pattern is contractual safeguards plus a documented transfer assessment retained for ODPC inquiries, with data-center localization mandates limited to specific government datasets rather than general commercial data.

Nearly, with four additions: (1) ODPC registration with 24-month renewal tracking, the visible duty with no GDPR equivalent; (2) DPO practice, the Act encourages and the regulations detail designation, and registered entities commonly appoint one though it is not universally mandatory; (3) transfer files reworked to Section 48's proof-of-safeguards framing rather than EU instrument citations; (4) consent hygiene for photos, marketing, and lending-adjacent data, reflecting where Kenyan enforcement concentrates. Notices should reference Kenyan law and the ODPC complaint channel. The rights pipeline, security program, and breach process (notify the ODPC within 72 hours of becoming aware, where there is real risk of harm) port from a GDPR base with addressee changes.