Data Protection Act

1 Short title

2 Interpretation

This section defines key terms throughout the Act, including anonymisation, biometric data, consent as express unequivocal free specific and informed indication, data subjects, controllers and processors, sensitive personal data, processing (collection, storage, retrieval, disclosure and erasure by any means), profiling (automated processing to evaluate aspects concerning race, health, behaviour, location and similar characteristics), personal data breaches (unauthorised destruction, loss, alteration or disclosure), pseudonymisation, and third parties.

3 Object and purpose of this Act

The Act aims to regulate personal data processing according to specified principles, protect individual privacy, establish legal and institutional mechanisms for data protection, and provide data subjects with rights and remedies.

4 Application

The Act applies to personal data processing recorded by automated or non-automated means that forms a filing system, and to data controllers or processors established in Kenya or processing data of Kenyan residents regardless of where they are based.

5 Establishment of the Office

The Office of the Data Protection Commissioner is established as a body corporate designated as a State Office, headed by the Data Commissioner as accounting officer. The Office may sue and be sued, hold property, enter contracts, ensure reasonable access to services throughout the country, and establish directorates necessary for its functions.

6 Appointment of the Data Commissioner

The Public Service Commission initiates recruitment when a vacancy arises, invites applications within seven days, shortlists and interviews qualified candidates within twenty-one days, and nominates three qualified persons in order of merit. The President nominates one of the three nominees with National Assembly approval for appointment.

7 Qualifications of Data Commissioner

The Data Commissioner must hold a university degree in data science, law, information technology or related field, have at least ten years of relevant knowledge and experience, meet Chapter Six Constitutional requirements, and hold a Master's degree. The Commissioner is appointed for a single six-year non-renewable term.

8 Functions of the Office

The Office enforces the Act, maintains registers of data controllers and processors, exercises oversight of data processing operations, promotes self-regulation, receives complaints about rights infringements, conducts inspections and assessments, promotes public awareness, undertakes research on data processing developments, and ensures international compliance. The Data Commissioner acts independently and may collaborate with national security organs.

9 Powers of the Office

The Data Commissioner may conduct investigations, obtain professional assistance, facilitate dispute resolution, issue summons, require explanations and information from regulated persons, impose administrative fines for non-compliance, and exercise powers under other legislation. The Commissioner may enter associations with bodies within and outside Kenya.

10 Delegation by the Data Commissioner

The Data Commissioner may transfer powers granted by this Act or other legislation to a regulator created by parliamentary legislation, subject to conditions the Commissioner sets.

11 Vacancy in the Office of the Data Commissioner

The Data Commissioner's office becomes vacant upon death, resignation in writing to the President, imprisonment for over six months without a fine option, or removal on grounds of mental or physical inability to work, breach of Constitution Chapter Six, bankruptcy, incompetence, or gross misconduct.

12 Removal of the Data Commissioner

Any person may lodge a complaint with the Public Service Commission to remove the Data Commissioner on grounds listed in section 11(d). The Commission must investigate expeditiously, report findings, and recommend action to the Cabinet Secretary, but must first notify the Commissioner in writing of removal grounds and allow a defence response.

13 Staff of the Office

The Data Commissioner appoints staff in consultation with the Public Service Commission as necessary to properly and efficiently carry out functions under this Act or other relevant laws.

14 Remuneration of the Data Commissioner and staff

The Salaries and Remuneration Commission determines payment of remuneration or allowances for the Data Commissioner and Office staff.

15 Oath of office

The Data Commissioner must take the oath specified in the First Schedule upon appointment.

16 Confidentiality agreement

The Data Commissioner and Office staff must not disclose information obtained for purposes of this Act unless they have lawful authority to do so.

17 Protection from personal liability

The Data Commissioner and Office staff are not liable for performing their functions in good faith and according to this Act.

18 Registration of data controllers and data processors

No person may act as a data controller or processor without registration with the Data Commissioner, subject to exceptions. The Data Commissioner sets registration thresholds by considering industry nature, data volumes, sensitive data processing, and other criteria.

19 Application for registration

Data controllers or processors required to register must apply with particulars including data descriptions, processing purpose, data subject categories, contact details, risk and security descriptions, indemnity measures, and any other prescribed details. Knowingly providing false details is an offence. The Commissioner issues a registration certificate when requirements are met, and applicants must notify changes to registration particulars.

20 Duration of the registration certificate

A registration certificate is valid for a period determined at application time considering the certificate's necessity and use, and holders may apply for renewal after expiry.

21 Register of data controllers and data processors

The Data Commissioner maintains a public register of registered data controllers and processors that anyone may inspect. Entry removal may be requested by the registered entity, and certified copies are available upon request.

22 Cancellation or variation of the certificate

The Data Commissioner may vary or cancel a registration certificate after issuing notice to show cause if the applicant provided false or misleading information, or if the certificate holder unlawfully fails to comply with the Act.

23 Compliance and audit

The Data Commissioner may conduct periodic audits of data controller and processor systems and operations to verify compliance with the Act.

24 Designation of the Data Protection Officer

A data controller or processor may appoint a data protection officer if it is a public or private body (except courts in judicial capacity), or if its core activities involve regular systematic monitoring or processing of sensitive data. The officer must have relevant qualifications, may be an internal staff member provided no conflict of interest exists, and must advise on compliance, facilitate staff training, conduct impact assessments, and cooperate with the Data Commissioner. Contact details must be published and communicated to the Data Commissioner.

25 Principles of data protection

Data controllers and processors must ensure personal data is processed lawfully, fairly and transparently in line with privacy rights; collected for explicit and legitimate purposes not further processed incompatibly; adequate, relevant and necessary for those purposes; provided with valid explanation when concerning family or private affairs; accurate and current with prompt correction of inaccuracies; kept in identifiable form only as long as necessary; and not transferred outside Kenya without adequate safeguards or data subject consent.

26 Rights of a data subject

Data subjects have the right to be informed how their personal data will be used, to access their data, to object to its processing, and to correct or delete false or misleading data about themselves.

27 Exercise of rights of data subjects

A minor may exercise data subject rights through a parent or guardian, a person with mental or other disability through an authorized guardian or administrator, and others through a person authorized by the data subject.

28 Collection of personal data

Controllers and processors must obtain personal data straight from the individual, except where data is in a public record, publicly shared by the individual, consented to indirectly by them, held with guardian consent for incapacitated individuals, unlikely to harm the individual, or needed for crime prevention, penalties enforcement, or protecting someone's interests. Controllers and processors must collect, store and use personal data only for lawful, specific and explicitly defined purposes.

29 Duty to notify

Before collecting personal data, data controllers and processors must inform the data subject about their rights, the fact and purpose of collection, third parties receiving the data with safeguard details, the controller's contacts, technical and organizational security measures, whether collection is legally required and voluntary or mandatory, and consequences of non-provision.

30 Lawful processing of personal data

Data controllers and processors may only process personal data if the subject consents or if processing is necessary for contract performance, legal compliance, vital interests protection, public interest tasks, historical or scientific research. Further processing must align with the original collection purpose. Contravention of these requirements constitutes an offense.

31 Data protection impact assessment

Controllers and processors must conduct an impact assessment before processing operations that are likely to create high risk to data subjects' rights and freedoms, covering the processing operations, their purposes and necessity, risks to rights, and protective measures. If the assessment shows high risk, they must consult the Data Commissioner. Assessment reports must be submitted sixty days before processing begins, and the Data Commissioner will issue guidelines for conducting assessments.

32 Conditions of consent

Controllers and processors must prove they obtained a data subject's consent for the specific processing purpose. Data subjects can withdraw consent at any time, though prior processing based on earlier consent remains lawful. Whether consent was freely given is determined partly by whether contract performance or service provision is tied to processing personal data that is not necessary for that contract.

33 Processing of personal data relating to a child

Controllers and processors may not process a child's personal data unless a parent or guardian consents and the processing protects and advances the child's rights and interests. They must incorporate age verification and consent mechanisms, chosen based on available technology, volume of data, proportion of children's data, risk of harm, and factors the Data Commissioner specifies. Providers giving exclusively counselling or child protection services to children are exempt from obtaining parental consent.

34 Restrictions on processing

Controllers and processors must restrict processing when a data subject requests it because the data's accuracy is disputed, no longer needed for the original purpose, processing is unlawful and erasure is opposed, or the data subject objects pending verification of legitimate interests. When restricted, data may be processed only with consent, for legal claims, protection of others' rights, or public interest. Controllers must implement mechanisms to observe time limits for correction, deletion, or restriction, and inform subjects before lifting restrictions.

35 Automated individual decision making

Data subjects have a right not to be subject to decisions based solely on automated processing, including profiling, that have legal effects or significantly affect them, unless the decision is necessary for contract entry or performance, authorized by law with suitable safeguards, or based on consent. When a controller or processor makes such a decision, they must notify the subject in writing and, on reasonable request, reconsider it or take a new non-automated decision, complying within a reasonable period and reporting the steps and outcome. The Cabinet Secretary may set further regulations to safeguard rights in automated decisions.

36 Objecting to processing

Data subjects have a right to object to processing of their personal data unless the controller or processor shows compelling legitimate interests that override the subject's interests or processing is needed for legal claims.

37 Commercial use of data

Nobody may commercially use personal data unless they have explicit permission from the individual or are authorised by another law and informed the person when collecting it. Controllers and processors using data commercially should anonymise it wherever feasible so the individual becomes unidentifiable. The Cabinet Secretary may issue guidelines on commercial data use with the Data Commissioner.

38 Right to data portability

Data subjects may receive their personal data in a structured, commonly used, machine-readable format and may transmit it to another controller or processor without hindrance, or have it transmitted directly where technically possible. The Data Commissioner may determine a controller's or processor's technical capacity if they refuse such requests. This right does not apply where processing is necessary for public interest tasks or official authority, or where it would adversely affect others' rights and freedoms.

39 Limitation to retention of personal data

40 Right of rectification and erasure

Individuals may ask controllers or processors to promptly correct inaccurate, outdated, incomplete or misleading data or promptly destroy data they are not entitled to keep, data that is irrelevant, excessive or unlawfully obtained. Controllers must inform third parties processing such data of the individual's request for correction or destruction. Where data is evidence, controllers or processors must restrict its use instead and notify the individual within a reasonable time.

41 Data protection by design or by default

Data controllers and processors must implement suitable technical and organisational safeguards to uphold data protection principles effectively, both when deciding how to process and during actual processing. By default, only personal data needed for a specific purpose may be processed, considering the volume collected, extent of processing, storage duration, accessibility, and processing costs. Recommended measures include identifying foreseeable risks, maintaining safeguards against them, applying pseudonymisation and encryption, ensuring timely data recovery after incidents, verifying safeguard effectiveness, and updating safeguards as risks or gaps emerge.

42 Particulars of determining organisational measures

When determining suitable safeguards, particularly for data transmitted over networks, controllers must account for available technology, implementation costs, special processing risks, and data nature. Controllers using processors must choose those providing sufficient organisational guarantees under section 41, and must sign a written contract binding the processor to follow only the controller's instructions and comply with the controller's obligations. A processor becomes a controller if processing data beyond the controller's instructions; controllers and processors must ensure their staff complies with security measures.

43 Notification and communication of breach

When unauthorised access to personal data creates real risk of harm, controllers must alert the Data Commissioner within seventy-two hours and write the individual within a practical timeframe unless identity is unknown. Delays in notifying the Commissioner must be explained. Processors must alert controllers within forty-eight hours when aware of a breach.

44 Processing of sensitive personal data

Sensitive personal data may not be processed unless section 25 permits it.

45 Permitted grounds for processing sensitive personal data

Sensitive personal data may be processed by foundations, associations and not-for-profit bodies with political, philosophical, religious or trade union purposes if processing occurs only for their members or regular contacts and data is not disclosed externally without consent. Processing is also permitted where data is publicly made available by the subject, or where necessary for establishing or exercising legal claims, fulfilling controller or subject obligations and rights, or protecting vital interests of incapable subjects.

46 Personal data relating to health

Health data may only be processed by healthcare providers or under their supervision, or by people bound by professional confidentiality requirements under law. This condition is satisfied if processing serves public health reasons or is done by someone owing confidentiality obligations under law.

47 Further categories of sensitive personal data

The Data Commissioner may prescribe additional categories of sensitive personal data and specify grounds for processing them, considering the risk of significant subject harm, confidentiality expectations, whether a discernible class faces significant harm, and protection adequacy under standard provisions. The Commissioner may also specify other personal data categories requiring additional safeguards or restrictions.

48 Conditions for transfer out of Kenya

Controllers and processors may transfer personal data outside Kenya only if they prove appropriate security safeguards to the Data Commissioner, including in jurisdictions with equivalent protection laws, or if transfer is necessary for performing contracts with subjects or third parties at the subject's request, serving public interest, establishing or defending legal claims, protecting vital interests of incapable subjects, or pursuing the controller's or processor's legitimate interests not outweighed by subjects' interests, rights and freedoms.

49 Safeguards prior to transfer of personal data out of Kenya

Sensitive personal data may only be transferred outside Kenya with subject consent and confirmation of appropriate safeguards. The Commissioner may require transferrers to demonstrate safeguard effectiveness or compelling legitimate interests, and may prohibit, suspend, or condition transfers to protect subject rights and freedoms.

50 Processing through a data server or data centre in Kenya

The Cabinet Secretary may prescribe that certain processing types must occur only through servers or data centres in Kenya based on state strategic interests or revenue protection grounds.

51 General exemptions

No exemption relieves controllers or processors from following lawful processing, collection minimisation, data quality and security protections. Processing is exempt if it involves personal household activities, serves national security or public interest, or is required by law or court order.

52 Journalism, literature and art

Processing principles do not apply when processing for publishing literary or artistic material if the controller reasonably believes publication serves the public interest and that compliance would conflict with the special purpose, provided the processing follows a relevant code of ethics. The Data Commissioner shall prepare guidance on this exemption.

53 Research, history and statistics

Further processing for historical, statistical or research purposes is compatible with original collection purposes if results are not published in identifiable form and appropriate safeguards prevent other uses. Processing for research alone is exempt if conducted under relevant conditions and results do not identify data subjects. The Data Commissioner shall prepare guidance.

54 Exemptions by the Data Commissioner

The Data Commissioner has discretionary authority to prescribe additional exemptions from certain provisions of this Act.

55 Data-sharing code

The Data Commissioner may issue a code containing practical guidance on sharing personal data under data protection laws and promoting good practice, with specific provisions addressing lawful exchange between government departments or public sector agencies.

56 Complaints to the Data Commissioner

Data subjects aggrieved by a person's decision may lodge complaints orally or in writing, with oral complaints recorded in writing. Complaints must contain prescribed particulars and be investigated and concluded within 90 days.

57 Investigation of complaints

The Data Commissioner may order persons to attend oral examination, produce relevant documents or records, or furnish written statements under oath. For electronically stored information, the Commissioner may require production in accessible and legible form. Failure without reasonable excuse or furnishing false information is an offence.

58 Enforcement notices

The Data Commissioner may issue enforcement notices when someone breaches the Act, specifying the breach, remedial steps, a minimum twenty-one-day period for compliance, and appeal rights. Persons who without reasonable excuse fail to comply commit an offence punishable by a fine up to five million shillings or imprisonment up to two years, or both.

59 Power to seek assistance

The Data Commissioner may seek assistance from any person or authority deemed fit and reasonably necessary to gather information or conduct investigations under the Act.

60 Power of entry and search

Upon obtaining a court warrant, the Data Commissioner may enter and search premises to discharge functions or exercise powers under this Act.

61 Obstruction of Data Commissioner

A person who obstructs, impedes, or fails to assist the Data Commissioner in exercising powers under section 9, refuses entry to premises, or provides false or misleading information commits an offence. Conviction results in a fine up to five million shillings, imprisonment up to two years, or both.

62 Penalty notices

63 Administrative fines

The Data Commissioner may impose a financial penalty of not more than five million shillings for each breach of the Act, or for an undertaking, not more than one percent of the prior year's annual revenue, applying whichever amount is lower.

64 Right of appeal

A person subject to administrative action by the Data Commissioner, including action through enforcement notices or penalty notices, has the right to seek review before the High Court.

65 Compensation to a data subject

A person suffering damage from a breach of the Act may claim compensation from the data controller or processor. Controllers are liable for any damage caused by their processing; processors are liable only if they failed to comply with an obligation specifically directed at them or acted outside or contrary to the controller's instructions. Neither is liable if they prove they are not responsible for the event causing the damage.

66 Preservation Order

The Data Commissioner may request a court to issue an order requiring quick preservation of personal data, including traffic data, when there is reason to believe the data is at risk of destruction or alteration.

67 Funds of the Office

The Office's funds and assets consist of monies allocated by the National Assembly, grants or donations given to the Office, and funds acquired through performing its functions under this Act or other written law.

68 Annual estimates

The Data Commissioner must prepare budget forecasts at least three months before each financial year starts, covering staff costs, retirement benefits, equipment, training and development, reserve funds, and other operational expenses, then present these to the Cabinet Secretary for parliamentary consideration.

69 Accounts and Audit

The Office's yearly financial records must be prepared, verified by auditors, and reported following the Constitution's Articles 226 and 229, the Public Finance Management Act, and other applicable public entity audit rules.

70 Annual reports

The Data Commissioner must deliver to the Cabinet Secretary within three months of year-end a report covering the Office's financial records, activity descriptions, statistics, impact assessments, operational barriers, and other relevant information, which the Cabinet Secretary then presents to parliament within three months.

71 Regulations

The Cabinet Secretary may create regulations to implement the Act and prescribe required matters, including data controller and processor obligations, certification mechanisms, notice and registration content, data subject information requirements, fee collection, safeguarding rights, data server processing in Kenya, and codes of practice. The Cabinet Secretary's authority is limited to effectuating the Act's provisions and must comply with the Statutory Instruments Act, Interpretation and General Provisions Act, and applicable international law.

72 Offences of unlawful disclosure of personal data

Data controllers who disclose personal data incompatibly with its collection purpose commit an offence; data processors who disclose without the controller's authority commit an offence. Any person obtaining or disclosing personal data without prior authority from the controller or processor commits an offence, unless the person is an employee or agent acting within their mandate. Offering to sell personal data obtained in breach of these provisions constitutes an offence; advertising personal data for sale is considered an offer to sell.

73 General penalty

A person convicted of an offence under the Act without specific penalty provision faces a fine up to three million shillings or imprisonment up to ten years, or both. Courts may additionally order forfeiture of equipment or articles used in committing the offence, or order prohibition of acts causing continuing contraventions.