Who it applies to
Data controllers and processors established in Kenya, or processing personal data of people in Kenya. Registration with the Office of the Data Protection Commissioner (ODPC) is required unless an organization is below both the turnover and staff thresholds, and certain sectors, including financial services, insurance and telecommunications, must register regardless of size.
Key obligations
| Requirement | What it means in practice |
|---|---|
| Security safeguardsSection 41 | Appropriate technical and organizational measures, including identifying risks, safeguards such as pseudonymisation and encryption, the ability to restore data after an incident, and regular testing that the safeguards work.Data Loss PreventionDatabase Activity MonitoringIdentity & Privileged Access |
| Breach notificationSection 43; General Regulations, reg. 37 | Notify the Data Commissioner without delay and within 72 hours of becoming aware of a breach that creates a real risk of harm, with reasons if late. Processors must tell the controller within 48 hours where reasonably practicable. Affected people must be told in writing within a reasonably practical period, unless safeguards such as encryption protect the data. Record every breach internally.Detection & Response |
| Data protection impact assessmentSection 31; General Regulations, reg. 49 | Carry out a DPIA before processing likely to result in high risk, such as large-scale processing, biometrics, profiling or automated decisions, combining datasets, or new technologies.vCISO, GRC & Privacy |
| Data protection officerSection 24 | Organizations may designate a DPO, particularly where core activities involve regular and systematic monitoring of people or sensitive personal data. A group of companies may share one DPO. |
| RegistrationSection 18; Registration Regulations, 2021 | Register with the ODPC unless exempt. Certificates are valid for 24 months and renewal should be applied for before expiry. |
| Transfers outside KenyaSections 48 to 50; General Regulations, reg. 26 | Transfers need proof of appropriate safeguards or another lawful ground; sensitive data also needs consent. Certain processing of strategic interest to the state must be done in Kenya, or keep at least one serving copy in Kenya. |
| PenaltiesSection 63 | Administrative fines of up to KES 5 million, or 1% of the previous year's annual turnover for an undertaking, whichever is lower. |
Good to know
- Encryption matters twice: it is a named safeguard, and it can remove the duty to notify affected people when encrypted data is breached.
- Breach assessment should start at detection. Monitoring that spots incidents early leaves time to assess and report within 72 hours.
How we help
We translate these requirements into practical controls: a gap assessment against your current environment, then the technology, processes and evidence that close the gaps. Start with the area that matters most:
- Data Loss Prevention: sensitive data is leaving the organisation.
- Database Activity Monitoring: we can't see who is accessing our databases.
- Identity & Privileged Access: too many people have too much access.
- Detection & Response: too many alerts and not enough visibility.
- vCISO, GRC & Privacy: risk and compliance live in spreadsheets.
- vCISO, GRC & Privacy: governance, risk management, DPIAs and DPO-as-a-service.
Sources
This summary is general information, not legal advice. Requirements change; confirm with the regulator or your legal advisers.