Data Protection Act, 2019

The Data Protection Act, 2019 (Act No. 24 of 2019) is Kenya's principal statute governing the collection, processing, storage, and disclosure of personal data. Published in the Kenya Gazette Supplement on 8 November 2019 and commencing on 25 November 2019, it gives legislative effect to Article 31 of the Constitution of Kenya 2010, which guarantees every person the right to privacy. The Act applies to any data controller or data processor established in Kenya, and extends extraterritorially to controllers and processors established outside Kenya that process the personal data of individuals located in Kenya. Controllers that are not established in Kenya but are caught by this extraterritorial reach must designate a local representative. The Act establishes the Office of the Data Protection Commissioner (ODPC) as Kenya's independent supervisory body. The Data Protection Commissioner is empowered to register data controllers and processors, conduct audits, investigate complaints, issue enforcement notices, and impose fines for non-compliance. All data controllers and data processors are required to register with the ODPC prior to processing personal data. Processing must rest on a recognised lawful basis: explicit consent, contractual necessity, a legal obligation, the vital interests of the data subject, a public task, or the legitimate interests of the controller. Sensitive personal data, defined to include data revealing health status, racial or ethnic origin, political opinions, religious or philosophical beliefs, biometric data, genetic data, and data relating to a child, is subject to stricter requirements and may only be processed on additional grounds, including explicit consent or specific statutory authority. Data subjects enjoy a range of rights: the right to be informed about processing, the right to access their data, the right to rectification of inaccurate or incomplete data, the right to erasure in certain circumstances, the right to restriction of processing, the right to data portability, and the right to object to processing. Cross-border transfers of personal data are permitted only where the recipient country provides an adequate level of data protection, or where the controller has implemented appropriate safeguards such as standard contractual clauses or binding corporate rules. Data breach notification obligations apply: controllers must notify the ODPC and, where necessary, affected data subjects within defined timeframes upon becoming aware of a breach. Penalties include administrative fines of up to KES 5 million for organisations and KES 3 million for individuals, as well as criminal sanctions of up to ten years' imprisonment for serious violations.

1. 1Establishes the Office of the Data Protection Commissioner (ODPC) as Kenya's independent supervisory and enforcement authority for data protection.
2. 2Requires all data controllers and data processors to register with the ODPC as a prerequisite to processing personal data.
3. 3Applies extraterritorially to controllers and processors outside Kenya that process the personal data of individuals located in Kenya, who must designate a local representative.
4. 4Provides data subjects with rights to access, rectification, erasure, restriction of processing, data portability, and objection to processing.
5. 5Imposes heightened requirements on the processing of sensitive personal data, including health, biometric, genetic, and racial or ethnic origin data, which must rest on specific lawful grounds.
6. 6Restricts cross-border transfers of personal data to jurisdictions with adequate protection or where appropriate safeguards such as standard contractual clauses are in place.
7. 7Requires data controllers to notify the ODPC of personal data breaches within 72 hours of becoming aware of the breach.
8. 8Provides for administrative fines of up to KES 5 million for organisations and criminal penalties of up to ten years' imprisonment for serious violations.