3 min read469 words
This question comes up constantly in SME forums and tech Slack groups: "We collect customer emails and phone numbers — does the DPA apply to us?" The short answer is almost certainly yes. Here is what the law actually requires.
Who does the Data Protection Act 2019 apply to?
The Act applies to the processing of personal data in Kenya, or where the data subject is in Kenya. It applies to both data controllers (those who determine the purposes of processing) and data processors (those who process data on behalf of a controller).
If your business collects customer names, email addresses, phone numbers, location data, payment information, or any other information relating to an identified or identifiable individual in Kenya — you are a data controller and the Act applies to you.
What you must do: key obligations
- Register with the ODPC: Section 16 requires all data controllers and data processors to register with the Office of the Data Protection Commissioner (ODPC)
- Publish a privacy notice: You must inform data subjects of the purposes of processing, the legal basis, their rights, and your contact details.
- Maintain a record of processing activities: Required under Section 31 for organisations processing data at significant scale.
- Implement data security measures: Section 41 requires technical and organisational measures appropriate to the risk.
- Appoint a Data Protection Officer (DPO): Required where processing is large-scale, involves special categories of data (health, biometrics, financial), or involves systematic monitoring of individuals (Section 24).
- Report data breaches: Breaches that risk harm to data subjects must be reported to the ODPC within 72 hours of becoming aware (Section 43).
Legal bases for processing
Under Section 30, you may only process personal data if you have one of the following lawful basis: consent; performance of a contract; compliance with a legal obligation; protection of vital interests; public interest; or legitimate interests (with balancing test).
Consent must be freely given, specific, informed, and unambiguous and so re-ticked boxes do not qualify.
Under Section 49, personal data may only be transferred outside Kenya to a country that provides an adequate level of protection, or where the data subject has given explicit consent. Many Kenyan businesses use US-based cloud services (Google Workspace, AWS, Salesforce) without addressing this. The ODPC has issued guidelines — and enforcement activity is increasing.
Penalties for non-compliance
Failure to register with the ODPC: up to KES 3 million or imprisonment for 3 years, or both. Broader compliance failures: administrative fines up to KES 5 million or 1% of annual turnover (whichever is higher).
Susan Musyoka is a PECB-certified Data Protection Officer. Gallant Law offers DPO-as-a-service for organisations that require a qualified DPO but do not need one full-time — a cost-effective compliance solution for growing businesses.
Not sure if you're compliant?
We conduct ODPC compliance audits and handle registration. Get in touch with us.
Talk to Gallant before you make the decision
If this raises a question specific to your situation, we are glad to talk it through.
This article is general legal information, not legal advice, and does not create a lawyer–client relationship.