Kenya's Data Protection Act, 2019: what it says and where to get it
Office of the Data Protection Commissioner · sources read 4 Oct 2026
Kenya's main privacy law is the Data Protection Act, 2019 (No. 24 of 2019), in force since 25 November 2019. You can download the official text, plus its 2021 regulations and guidance notes, free from the ODPC website.
- Where
- Online on the ODPC website (odpc.go.ke), or the ODPC office at Britam Towers, 12th Floor, Hospital Road, Upperhill, Nairobi
Steps
- Open the ODPC 'Regulatory Framework' page (odpc.go.ke/data-protection-laws-kenya) and download the Data Protection Act, 2019. It sets up the ODPC, regulates how personal data is handled and lists people's rights and companies' duties.
- On the same page, get the 2021 regulations that add the detail: General, Registration of Data Controllers and Data Processors, and Complaints Handling and Enforcement.
- If you collect data, follow the core rules: handle it lawfully, fairly and openly, for a clear purpose, only what you need, kept accurate and not longer than necessary.
- Check whether your business must register with the Data Commissioner as a data controller or processor; the law bars acting as one without registration, subject to thresholds the Commissioner sets.
- Use the ODPC guidance notes for your sector, for example small businesses (MSMEs), education, health data, consent and children's data.
Watch out
- A company that suffers a data breach with a real risk of harm must tell the Data Commissioner within 72 hours of finding out.
- The Data Commissioner can fine up to KSh 5 million, or for a business up to 1% of last year's turnover, whichever is lower.
- Consent is not the only legal ground: data may also be processed when needed for a contract, a legal duty or public tasks, among others.
Who this covers
- It covers anyone who handles personal data in Kenya, and also firms outside Kenya that handle data of people in Kenya.
- It gives every person rights over their data, such as being told how it is used and getting access to it.
Official sources (3)
- Regulatory Framework odpc.go.ke · read 4 Oct 2026
- The Data Protection Act, No. 24 of 2019 odpc.go.ke · read 4 Oct 2026
- Guidelines odpc.go.ke · read 4 Oct 2026