Data protection & privacy law in Kenya (2026)
Data protection in Kenya: comprehensive law.
Kenya has a comprehensive, GDPR-style personal-data protection regime: the Data Protection Act, 2019 (assented 8 Nov 2019; commenced 25 Nov 2019) establishes an independent Office of the Data Protection Commissioner (ODPC), codifies lawful-basis rules, data-subject rights, mandatory registration, and cross-border transfer conditions. Enforcement has shifted from awareness-building to active supervision in 2025–2026, with hundreds of compensation orders, enforcement notices, and penalty notices issued, and a Data Protection (Amendment) Bill 2025 proposing new AI, cross-border, and penalty provisions.
Legal framework
Data Protection Act, No. 24 of 2019, supervised by the Office of the Data Protection Commissioner (ODPC); supplemented by the Data Protection (General) Regulations, 2021, Registration of Data Controllers & Processors Regulations, 2021, and Complaints Handling & Enforcement Procedure Regulations, 2021.
Key points: data & privacy in Kenya
Primary law & regulator
The Data Protection Act, 2019 is in force and gives effect to Article 31(c)(d) of the Constitution. It establishes the ODPC as an independent state office under the Ministry of Information, Communications and the Digital Economy, with powers to register, investigate, audit, order compensation, and impose penalties.
Mandatory registration of controllers/processors
No person may act as a data controller or data processor without being registered with the Data Commissioner. Entities with turnover above KES 5 million or more than 10 employees must register; prescribed sectors (financial services, health, telecoms, education, etc.) must register regardless of size.
Data-subject rights & controller duties
The Act codifies principles of lawfulness, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability, and grants rights of information, access, objection, rectification, erasure, data portability and protection against automated decisions. Controllers must undertake DPIAs and notify breaches to the ODPC within 72 hours.
Cross-border transfers & localisation
Section 48 permits transfers abroad only where the Data Commissioner is satisfied of appropriate safeguards (adequacy, binding corporate rules, standard contractual clauses) or where a statutory ground (consent, contract, vital/public interest) applies. Sensitive personal data and certain strategic-interest data must have at least one serving copy stored on a server or data centre in Kenya.
Penalties and enforcement intensity
The ODPC may issue administrative penalties of up to KES 5 million or 1% of annual turnover (whichever is lower); criminal offences can attract fines of KES 3 million and/or imprisonment of up to 10 years. By 2026 the ODPC had received more than 9,000 complaints and issued 184 compensation orders, 134 enforcement notices and 20 penalty notices, with active audits of banks, microfinance institutions and digital lenders.
Legislative evolution
A Data Protection (Amendment) Bill, 2025 is before Parliament proposing new obligations around artificial intelligence, cross-border data sharing, and higher penalties; draft Conduct of Compliance Audit Regulations give the ODPC a formal framework for on-site and desk audits. These are proposals/sub-legislation layered on the comprehensive Act already in force.
Timeline of decisions
- EnforcementODPC confirms deletion of Worldcoin biometric data
The Office of the Data Protection Commissioner issued an official notice confirming that Worldcoin/Tools for Humanity had permanently deleted all biometric (iris) data collected from Kenyans, closing out the long-running enforcement saga.
Business Daily
- DecisionHigh Court declares Worldcoin data collection unlawful
The High Court ruled that Worldcoin's iris-scanning in Kenya breached the Data Protection Act 2019, collecting sensitive data without a Data Protection Impact Assessment or valid informed consent, and ordered permanent deletion within seven days under ODPC supervision.
Techpoint Africa
- EnforcementDigital lender Whitepath fined KES 250,000
The ODPC fined digital lender Whitepath for listing an individual as a guarantor without consent and subjecting them to debt-collection calls, its second sanction against the lender, reinforcing scrutiny of the mobile-lending sector.
TechCabal
- DecisionWananchi Group (Zuku Fibre) fined KES 500,000
The ODPC fined Zuku Fibre's parent for continuing to send unsolicited marketing messages to a former customer who had terminated service and repeatedly requested data deletion, affirming the right to erasure and to object to direct marketing.
The Lawyer Africa
- Enforcement · officialODPC issues three penalty notices totalling KES 9.375M
In a precedent-setting move, the ODPC fined Mulla Pride (KES 2.975M), Roma School (KES 4.55M) and Casa Vera Lounge (KES 1.85M) for unlawful debt-collection messaging and posting individuals'/minors' photos without consent, its first substantive penalty determinations.
ODPC
- Enforcement · officialODPC issues first major data-protection penalties
The Office of the Data Protection Commissioner imposed precedent-setting fines (including against Whitepath, Regus and Mulla Pride) for unlawful processing and unsolicited messaging, signalling active enforcement of the 2019 Act.
ODPC
- IncidentGovernment suspends Worldcoin operations in Kenya
The Ministry of Interior suspended Worldcoin's public iris-scanning operations over concerns about consent, data security and lack of safeguards for biometric data, triggering a formal ODPC data-protection investigation.
Africanews
- Enforcement · officialODPC issues its first-ever penalty notice (OPPO Kenya)
The Data Commissioner fined OPPO Kenya KES 5 million for failing to comply with an enforcement notice after posting an individual's image without consent, the regulator's debut use of its penalty powers.
ODPC
- Law · officialData Protection (General) Regulations 2021 enacted
Legal Notices 263-265 of 2021 operationalised the Act, the General, Registration, and Complaints Handling & Enforcement Regulations, detailing data-subject rights, cross-border transfers, breach notification, mandatory registration thresholds and complaint procedures (commenced 14 January 2022).
Kenya Law
- DecisionHigh Court halts Huduma Namba rollout pending DPIA
In Katiba Institute v Attorney General, the High Court declared rollout of the Huduma card illegal absent a Data Protection Impact Assessment, applying the Act retrospectively and setting a landmark precedent that state ID systems must comply with data-protection law.
Privacy International
- DecisionFirst Data Protection Commissioner sworn in
Immaculate Kassait was sworn in as Kenya's inaugural Data Commissioner (single six-year term), operationalising the Office of the Data Protection Commissioner and giving the 2019 Act an enforcement body.
IAPP
- Guidance · officialFirst Data Protection Commissioner appointed; ODPC operationalized
Kenya appointed its inaugural Data Protection Commissioner, activating the regulator responsible for enforcing automated-decision and profiling rights and high-risk processing safeguards. This stood up the institution that now anchors AI/data oversight.
Office of the Data Protection Commissioner
- Decision · officialFirst Data Protection Commissioner appointed; ODPC operationalised
The appointment of the inaugural Data Commissioner stood up the Office of the Data Protection Commissioner, giving Kenya a functioning independent authority to register controllers/processors and enforce data-protection (and breach-notification) duties.
ODPC
- DecisionHigh Court suspends NIIMS/Huduma Namba biometric ID system
One of the world's first constitutional rulings to halt an all-purpose biometric digital ID, the court found NIIMS could not proceed without an adequate data-protection legal framework and safeguards. It established judicial limits on state collection of sensitive biometric data.
Privacy International
- Law · officialData Protection Act, No. 24 of 2019 takes effect
Kenya's first comprehensive privacy law, modeled on the EU GDPR, gave effect to Article 31 of the Constitution and created the Office of the Data Protection Commissioner to govern handling of personal data online.
Laws of Kenya
- Law · officialData Protection Act, 2019 comes into force
Kenya's comprehensive, GDPR-aligned data-protection statute (Act No. 24 of 2019) took effect, giving effect to Article 31(c)(d) of the Constitution, establishing the ODPC and setting out lawful-processing principles, data-subject rights and cross-border transfer rules.
Kenya Law
- Law · officialData Protection Act 2019 Enacted, Binding Data Obligations on All Fintechs
Kenya's first comprehensive data protection statute imposed consent, purpose-limitation, and data-security requirements on any entity processing personal data, including fintechs; it was subsequently cross-referenced as a mandatory compliance obligation in the 2022 Digital Credit Providers Regulations.
Kenya Law
- Law · officialConstitution of Kenya entrenches the right to privacy
Article 31 of the 2010 Constitution guaranteed every person the right not to have information relating to their private affairs unnecessarily required or revealed and to keep communications private, the constitutional foundation for all subsequent data-protection law.
Kenya Law Reform Commission
Sources
- new.kenyalaw.org/akn/ke/act/2019/24/eng@2022-12-31
- odpc.go.ke/wp-content/uploads/2024/02/PERSONAL-DATA-PROTECTION-HANDBOOK.pdf
- digitalpolicyalert.org/event/27496-data-protection-act-2019-establishing-the-office-of-the-d
- digitalpolicyalert.org/digest/dpa-digital-digest-kenya
- research.lawlab.africa/kenya/
- hapakenya.com/2026/10/14/kenyan-banks-face-regulatory-heat-over-data-privacy-violat
Next for Kenya: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 15 Oct 2026. Methodology & how to cite · State of Technology Regulation 2026