Your rights over your personal data
Data Protection Act, 2019 · sources read 4 Oct 2026
You have the right to be told how your personal data will be used, to access it, to object to its use, and to have false or misleading data corrected or deleted. A company may keep your data only as long as reasonably needed for its purpose (unless the law or your consent allows longer), and may send it outside Kenya only under conditions set in the law.
- How long
- The Data Commissioner must investigate and finish a complaint within 90 days.
- Deadline
- A request for a portable copy of your data must be met within 30 days (longer if it is complex, in consultation with the Data Commissioner).
- Where
- First the company or office holding your data; then the Office of the Data Protection Commissioner (online at cie.odpc.go.ke)
Steps
- Ask the company or office holding your data to correct data that is wrong, out of date or misleading, or to delete data it has no right to keep. It must act without undue delay.
- You can ask for a copy of your data in a common, machine-readable format and move it to another provider.
- If you dispute that your data is accurate, you can ask them to restrict its use while they check.
- If they refuse or misuse your data, complain to the Data Commissioner, by speaking to them or in writing.
Watch out
- A company may keep data longer than needed for its purpose if the law requires it, it is reasonably needed for a lawful purpose, you consented, or it is for research or statistics.
- Your data can go outside Kenya only if the company has proved proper safeguards to the Data Commissioner, or the transfer is needed for reasons the law lists, such as a contract with you.
- Your right to object can be overridden if the company shows a compelling legitimate interest or needs the data for a legal claim. The right to refuse purely automated decisions also has exceptions, such as a contract or your consent.
Who this covers
- Anyone whose personal data a company, government office or other organisation holds or uses.
- For a child, a parent or guardian can use these rights.
Official sources (2)
- Data Protection Act, 2019 (No. 24 of 2019) new.kenyalaw.org · read 4 Oct 2026
- Constitution of Kenya, 2010 new.kenyalaw.org · read 2 Oct 2026