When a company needs your consent to use your personal data
Office of the Data Protection Commissioner · sources read 4 Oct 2026
A company or office may use your personal data only if you agree to a specific purpose, or if the law gives it another reason, such as a contract with you or a legal duty. If it relies on your consent, it must prove you gave it, tell you what it is for, and let you withdraw it at any time.
- Where
- First the company or office using your data; then the Office of the Data Protection Commissioner (online at cie.odpc.go.ke)
Steps
- Before you agree, check that they told you who they are, what each use is for, what data they collect, whether they share it, and that you can withdraw. They can tell you in writing, out loud, or by audio or video.
- To stop a use you agreed to, tell them you withdraw your consent. They must then stop that part of the processing. What they did before you withdrew stays lawful.
- If they used your data without a lawful reason or ignore your withdrawal, complain to the Data Commissioner, by speaking to them or in writing.
Watch out
- Consent does not count as freely given if it was assumed because you didn't object, buried as a non-negotiable part of the terms, mixed for several purposes at once, or if you can't refuse without losing out.
- Consent is not the only reason allowed. A company can use your data without asking if it is needed for a contract with you, a legal duty, to protect someone's life, public duties, legitimate interests or research.
- Using your data for commercial purposes needs your express consent, unless a written law allows it and you were told when the data was collected.
Who this covers
- Anyone whose personal data a company, government office or other organisation wants to collect or use.
Official sources (2)
- Data Protection Act, No. 24 of 2019 (Kenya Gazette Supplement No. 181) odpc.go.ke · read 4 Oct 2026
- Data Protection (General) Regulations, 2021 odpc.go.ke · read 4 Oct 2026