What is the Data Protection Act, 2019?
The Kenya Data Protection Act, 2019 (DPA) governs how organisations collect, store, use and share personal data about people in Kenya. It is enforced by the Office of the Data Protection Commissioner (ODPC), which registers data controllers and processors, handles complaints and can issue enforcement notices and fines.
"Personal data" is broad: names, phone numbers, ID numbers, M-Pesa details, email addresses, CCTV footage, staff records and patient or student files all count. If your business keeps any of these, the Act applies to you — whether you are a clinic, school, SACCO, shop, NGO or online store.
Data controllers vs data processors
A data controller decides why and how personal data is used (for example, a school deciding to keep parent contacts). A data processor handles data on a controller's behalf (for example, the IT company hosting that school's system). Both have obligations under the Act, and an organisation that plays both roles registers for each.
Key obligations for Kenyan businesses
- Lawful basis & consent — have a valid reason for every use of personal data, and get clear consent where that is the basis.
- Transparency — tell people what you collect and why, usually through a privacy notice.
- Data subject rights — let people access, correct, object to and request deletion of their data.
- Security safeguards — protect data with appropriate technical and organisational measures (access control, encryption, backups, staff training).
- Breach notification — report qualifying data breaches to the ODPC within 72 hours of becoming aware, and inform affected people where there is a real risk of harm.
- Data Protection Impact Assessments (DPIAs) — required before high-risk processing such as large-scale health data or systematic monitoring.
- Data Protection Officer (DPO) — designate one where your core activities involve large-scale monitoring or sensitive data. A DPO can be outsourced.
Do you need to register with the ODPC?
Under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, organisations processing personal data must register unless exempt.
Small organisations
Entities with an annual turnover below KSh 5 million and fewer than 10 employees are exempt from mandatory registration — unless they fall in a mandatory sector below.
Mandatory sectors (any size)
- Education & healthcare
- Hospitality, bars & restaurants
- Financial services, insurance & SACCOs
- Telecoms, transport & property management
- Direct marketing, gaming & betting
| Category (private sector) | Employees | Annual turnover | Registration fee |
|---|---|---|---|
| Micro & small | 1 – 50 | Up to KSh 5M | KSh 4,000 |
| Medium | 51 – 99 | KSh 5M – 50M | KSh 16,000 |
| Large | 100+ | Over KSh 50M | KSh 40,000 |
Registration certificates are valid for 24 months and must be renewed. Fees are the ODPC's, not ours — confirm current figures on odpc.go.ke before applying.
What happens if you don't comply?
The ODPC can issue enforcement notices and administrative fines of up to KSh 5 million or 1% of the previous year's annual turnover, whichever is lower. Data subjects can also lodge complaints and seek compensation. Beyond the fine, a public enforcement action or data breach can cost you customers' trust — which is usually the bigger loss.
DPA compliance & outsourced DPO services
KABSS FUSION takes you from "not sure where to start" to registered, documented and audit-ready.
DPA 2019 Compliance Starter Pack
- ODPC registration
- DPA gap assessment
- Privacy policy
- 2-hour staff training
October offer. ODPC fees billed separately.
Outsourced Data Protection Officer
- Named DPO for your organisation
- Handling data subject requests
- DPIAs for new systems
- Breach response & ODPC liaison
- Annual audits & refresher training
Security safeguards
- Encrypted backup & disaster recovery
- Access control & endpoint protection
- Data audits & retention schedules
- Paired with our cybersecurity services
Gap assessment
We map what personal data you hold, where it lives and who can see it, against the DPA and ODPC guidance.
Registration
We prepare and file your ODPC registration and keep renewal dates on record.
Policies & training
Privacy notice, data-handling procedures, breach plan and staff training tailored to your sector.
Ongoing DPO
Requests, DPIAs, breaches and annual audits handled — so compliance stays current.
Data Protection Act questions
Does the Data Protection Act apply to small businesses?
Who must register with the ODPC?
How much does ODPC registration cost?
What is the penalty for breaking the Data Protection Act?
Do I need a Data Protection Officer?
How long do I have to report a data breach?
Find out where you stand — free
Send us your sector and staff size on WhatsApp and we'll tell you whether you must register, what you're missing and what it will cost to fix.