Cyber security compliance in Kenya

Which cyber and data protection rules apply in Kenya?

The Data Protection Act 2019 applies to almost every organisation that handles personal data in Kenya, and to organisations abroad that process data about people in Kenya. The Computer Misuse and Cybercrimes Act 2018 creates the offences, and its 2024 regulations put duties on owners of critical information infrastructure. Sector regulators add their own rules: the Central Bank of Kenya for banks and payment service providers, the Insurance Regulatory Authority for insurers, and the Digital Health Agency for health information under the Digital Health Act 2023.

What does the Data Protection Act require?

Registration with the Office of the Data Protection Commissioner comes first. It is mandatory for every controller and processor except those with turnover or revenue below five million shillings and fewer than ten employees, and that exemption does not apply to organisations processing for purposes such as health care, education, financial services, telecommunications, transport or CCTV security. Certificates last 24 months, and in August 2026 the ODPC gave entities with expired certificates 14 days to renew.

Breaches are notified to the Data Commissioner within 72 hours of becoming aware of them, and processors must tell their controller within 48 hours where reasonably practicable. Impact assessments are required before high-risk processing. Fines reach KES 5 million or 1% of turnover, whichever is lower, and the ODPC uses them: Oppo Kenya was fined KES 5 million in December 2022, and penalty notices in September 2023 against a digital lender, a restaurant and a school totalled KES 9,375,000. In January 2026 the ODPC was reported to have registered more than 15,000 controllers and processors and to have issued 184 compensation orders.

Does Kenya require data to be stored in Kenya?

Not generally. Personal data can be transferred abroad with proof of appropriate safeguards or on another ground in section 48 of the Act. The exception is processing for the strategic interest of the state, which includes civil registration, elections, public finance, protected computer systems, basic education and primary or secondary health care: under regulation 26 of the General Regulations it must run through a server and data centre in Kenya, or keep at least a serving copy there. Owners of critical information infrastructure must also host it in Kenya under the 2024 cybercrime regulations.

What do the Central Bank and the Insurance Regulatory Authority require?

The CBK's Guidance Note on Cybersecurity of 2017 requires banks to run a board-overseen cybersecurity programme and to notify the CBK of significant incidents within 24 hours. Its 2019 Guideline on Cybersecurity for Payment Service Providers sets similar duties for payment service providers, including board accountability and a chief information security officer. In September 2025 the CBK launched a Banking Sector Security Operations Centre, and banks and payment providers were told to comply with both guidelines and the 2024 cybercrime regulations.

Insurers have had their own rules since 25 June 2025, when the IRA issued its Guidance Note on Cybersecurity for the Insurance Industry: a board-approved cybersecurity strategy, reporting of material incidents within 24 hours, quarterly incident reports and an annual review of policies.

What do the critical information infrastructure regulations require?

The Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations, Legal Notice 44 of 2024, published on 9 February 2024, let the National Computer and Cybercrimes Co-ordination Committee designate critical information infrastructure. Owners must complete a risk assessment, report incidents to their cybersecurity operations centre within 24 hours of becoming aware of them, submit annual compliance reports and host the infrastructure in Kenya. The regulations set up national, sector and critical infrastructure security operations centres.

The scale of probing is large. The national KE-CIRT/CC, run by the Communications Authority, detected more than 2.3 billion cyber threat events between April and June 2026, and was reported to have detected 11.1 billion in the year to June 2026, 29% more than the year before. These are detections of attack traffic and vulnerability activity, not confirmed breaches.

How does the Digital Health Act affect health data?

The Data Protection Act already limits processing of health data to health care providers and people bound by professional secrecy. The Digital Health Act 2023, in force since 2 November 2023, created the Digital Health Agency, and the Digital Health (Health Information Management Procedures) Regulations 2025 add rules on data custodianship, security operations, breach notification and archiving, and require digital health solutions to be certified by the Agency. Hospitals, insurers and health technology suppliers therefore answer to the ODPC and the Agency for the same records.

How GRCLens runs Kenyan frameworks together

The Data Protection Act, ISO/IEC 27001, PCI DSS and ISO/IEC 42001 share one control model in GRCLens, so a bank, payment provider or health insurer evidences access control, incident response or supplier assurance once for the ODPC, the CBK and its certification body. The 72-hour ODPC notice, the 24-hour sector notices and certificate renewal are tracked as their own items. GRCLens can run in your own private cloud or fully on-premises in Kenya, which matters where regulation 26 or the critical infrastructure regulations keep data in the country.

Official portals and publications

• ODPC, report a data breach
• Communications Authority, Cyber Security Report April to June 2026