Data Protection Act 2019 (Kenya) compliance software
Kenya's Data Protection Act 2019 with the General, Registration, and Complaints Handling and Enforcement Regulations of 2021: 94 controls across 12 domains, from ODPC registration and the 72-hour breach notice to an Assurance domain for audits, renewals and monitoring.
- RegulatorOffice of the Data Protection Commissioner (ODPC)
- InstrumentsData Protection Act No. 24 of 2019; General, Registration, and Complaints Handling and Enforcement Regulations, 2021
- Structure12 domains · 94 controls, 11 of them in the Assurance domain
- NotificationsBreach to the ODPC within 72 hours · processor to controller within 48 hours · fines up to KES 5 million or 1% of turnover, whichever is lower
What Kenya DPA requires
Who it applies to
- Data controllers and processors established or ordinarily resident in Kenya, and those outside Kenya that process personal data of data subjects located in Kenya
- Every organisation above the registration thresholds, and any organisation processing for a Third Schedule purpose, such as health care, education, financial services, telecommunications, transport including ride hailing, or security CCTV
- Data processors acting for a controller, bound by section 42 and by the contract particulars in the General Regulations
- Bodies processing for the strategic interest of the state, such as civil registration, elections, public finance, basic education and primary or secondary health care, which must process through a data centre in Kenya or keep a serving copy there
The Data Protection Act, No. 24 of 2019, commenced on 25 November 2019 and established the Office of the Data Protection Commissioner. Three sets of Regulations made in December 2021 give it working detail: the General Regulations (Legal Notice 263), in force since 14 January 2022; the Complaints Handling Procedure and Enforcement Regulations (Legal Notice 264); and the Registration of Data Controllers and Data Processors Regulations (Legal Notice 265), in effect since 14 July 2022. GRCLens carries 94 controls across 12 domains, quoted from the Act and all three instruments.
The domains cover registration and the data protection officer, the principles and lawful bases, consent and notification, data subject rights, impact assessments and privacy by design, security, retention and processors, breach notification, sensitive, health and children's data, transfers out of Kenya and the localisation rule in regulation 26, commercial use, direct marketing and automated decisions, and the respondent's side of ODPC complaints and enforcement. An Assurance domain of 11 controls covers the data protection officer's oversight tasks, audit readiness, testing of security measures, processor audit rights, certificate renewal and policy review; where a practice is derived rather than stated, the control says so.
A controller notifies the Data Commissioner within 72 hours of becoming aware of a breach that carries a real risk of harm, with reasons if it is later, and a processor tells the controller within 48 hours where reasonably practicable. Administrative fines reach five million shillings or, for an undertaking, 1% of the previous year's turnover, whichever is lower. The ODPC has used that ceiling: Oppo Kenya was fined KES 5 million in December 2022, and three penalty notices in September 2023 against a digital lender, a restaurant and a school totalled KES 9,375,000.
How GRCLens supports Kenya DPA
Kenya DPA runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Registration treated as a licence
The certificate's 24-month validity, renewal before expiry and the 14-day duty to notify changes in registered particulars are tracked, because processing on an expired certificate is an offence and the ODPC has publicly chased lapsed registrations.
The 72-hour and 48-hour clocks
Awareness, the ODPC notification with reasons for any delay, the processor's notice to the controller and written communication to data subjects are separate controls with their own evidence.
Impact assessments from the regulation's triggers
DPIA controls follow the triggers in regulation 49 and the template in the General Regulations' Third Schedule, so a decision that no DPIA is needed is recorded as deliberately as a completed assessment.
Transfers and localisation
Transfers out of Kenya are assessed against section 48 and the four routes in regulation 40, and processing for the strategic interest of the state against the regulation 26 localisation rule.
Assurance, not only policy
Eleven controls test that the programme runs: the data protection officer's oversight, readiness for an audit by the Data Commissioner, verification of security measures, processor audits, renewals and policy updates.
Kenya DPA frequently asked questions
Who must register with the Data Protection Commissioner in Kenya?
Every data controller and processor, unless it has annual turnover or revenue below five million shillings and fewer than ten employees. That exemption does not apply to organisations processing for a Third Schedule purpose, such as health care, education, financial services, telecommunications or transport, which must register whatever their size.
How long is an ODPC registration certificate valid?
24 months from issue under the Registration Regulations. The ODPC advises applying for renewal at least 30 days before expiry, and continuing to process on an expired certificate is an offence.
How fast must a data breach be reported in Kenya?
Within 72 hours of the controller becoming aware of it, where there is a real risk of harm to data subjects, with reasons for any delay. A processor must tell the controller within 48 hours where reasonably practicable, and data subjects must be told in writing within a reasonably practical period.
What is the maximum fine under Kenya's Data Protection Act?
Five million shillings or, for an undertaking, 1% of annual turnover in the preceding financial year, whichever is lower, under section 63. A penalty notice may also impose a daily fine of up to KES 10,000 for each breach until it is put right.
Is a data protection officer mandatory in Kenya?
The Act says a controller or processor 'may' designate one, but the conditions in section 24 reach most public and private bodies, and once an officer is designated their contact details must be published and given to the ODPC. GRCLens treats appointment as expected practice.
One platform, many obligations
See all supported frameworks → Every framework that applies in Kenya →
Talk to us about Kenya DPA
Security Solution Consultants provides Kenya data protection and cyber security advisory alongside the platform, so you can combine tooling with hands-on expertise.