The Kenya Data Protection Act (KDPA) came into force in 2019. The Office of the Data Protection Commissioner (ODPC) began active enforcement from 2023. By 2026, fines are real, registration is being checked, and the 'we didn't know' defence is no longer available.
If your business collects, stores or processes personal data of Kenyan residents — customer names, phone numbers, national IDs, medical records, transaction history — you are a Data Controller or Data Processor under the KDPA. And you are required to comply.
What compliance actually requires
Most Kenyan businesses think KDPA compliance is a form you file with the ODPC. It is not. Compliance is an ongoing operational state involving policy, process, technology and staff behaviour.
→Registration: Data Controllers and Processors must register with the ODPC
→Privacy Policy: documented, specific, and accessible to data subjects
→Data mapping: you must know what data you collect, where it lives, and who can access it
→Consent: explicit consent required before collecting personal data
→Retention policy: defined periods — you cannot keep data indefinitely
→Security controls: technical measures to protect data (encryption, access controls, audit logging)
→Breach response: documented plan + ODPC notification required within 72 hours
→Data subject rights: process for access requests, corrections, and deletions
Who needs to worry about this?
The KDPA applies regardless of business size. If you process personal data of Kenyan residents, you are in scope. That includes:
✓Retail businesses with customer loyalty programmes or payment records
✓Healthcare providers — patient data is the highest-sensitivity category
✓Hotels collecting guest information
✓SACCOs and microfinance institutions
✓Any business with employees in Kenya
✓Online platforms and mobile apps with Kenyan users
✓Companies processing M-Pesa transaction data
Special categories of data — health information, biometric data, financial data and national ID numbers — attract higher scrutiny and stricter requirements. If your business handles any of these, compliance is not optional.
What the ODPC actually checks
ODPC enforcement has focused on larger organisations so far, but the Act applies to all businesses. What auditors and investigators typically look for:
✗No ODPC registration
✗No Privacy Policy or a generic one copied from the internet
✗No documented data retention or deletion policy
✗Personal data accessible to staff who don't need it
✗No record of how data was collected or what consent was given
✗No breach response plan — or worse, a breach that wasn't reported
The practical steps to get compliant
✓Step 1: Data audit — map what personal data you collect and where it goes
✓Step 2: Gap analysis — identify what's missing against KDPA requirements
✓Step 3: Register with the ODPC (Data Controller or Processor registration)
✓Step 4: Write and publish a proper Privacy Policy
✓Step 5: Implement technical controls — encryption, access control, audit logging
✓Step 6: Train staff — what counts as personal data and how to handle requests
✓Step 7: Establish breach response procedures and notification process
KDPA compliance isn't a one-day project. But it doesn't have to take months either. A structured engagement covering audit, gap analysis, policy writing and technical controls can be completed in 2–4 weeks for most Kenyan SMBs.
// NOT SURE WHERE YOU STAND?
Get a free IT & security check.
We identify the gaps and tell you exactly what to fix first.
