Personal data and online exposure: Kenya's Data Protection Act 2019
Kenya's data protection regime is real, enforced and increasingly relevant to online harm — but its erasure right is narrower than most people assume, and the constitutional route sitting beside it is often the stronger one.
The Data Protection Act, No. 24 of 2019, gave Kenya a comprehensive personal data regime and created the Office of the Data Protection Commissioner to administer it. For anyone dealing with online exposure — an unwanted photograph, a published document, a leaked record, an aggressive digital lender — it is now one of the more useful instruments available, and often faster than litigation.
It is also frequently described in terms borrowed from the European regime it resembles, and those descriptions get several important things wrong.
Who the Act applies to
Under section 4, the Act applies to processing by controllers and processors established or ordinarily resident in Kenya and processing personal data in Kenya. It also applies extraterritorially, under section 4(b)(ii), to controllers and processors not established or ordinarily resident in Kenya where they process the personal data of data subjects located in Kenya.
That extraterritorial limb matters. A foreign website, platform or service that processes the personal data of people in Kenya is within scope as a matter of Kenyan law, whatever the practical enforcement difficulties.
The principles
Section 25 requires that personal data be processed in accordance with the right to privacy; lawfully, fairly and transparently; collected for explicit, specified and legitimate purposes; adequate, relevant and limited to what is necessary; accurate and kept up to date; kept in identifiable form no longer than necessary; and not transferred outside Kenya without proof of adequate safeguards or consent.
One principle is distinctively Kenyan and tracks the constitutional text: personal data must be collected only where a valid explanation is given whenever information relating to family or private affairs is required. That mirrors Article 31(c) of the Constitution and gives a direct statutory hook for the “why are you asking for this at all?” objection.
Section 28 requires collection directly from the data subject, subject to exceptions including data contained in a public record, data deliberately made public by the subject, consent, and crime prevention or law enforcement.
Lawful bases
Section 30 permits processing where the data subject consents, or where processing is necessary for the performance of a contract; compliance with a legal obligation; protection of vital interests; performance of a task in the public interest; exercise of authority vested in the controller; performance of a public function; the legitimate interests of the controller; or historical, statistical, research or journalistic purposes.
That last basis, together with the Act’s exemptions, is the pivot on which any publisher-side defence turns. A journalism claim is not a magic word, but it is a genuine basis and should be assessed properly rather than dismissed.
Section 37 adds a separate requirement for the commercial use of personal data: express consent, or statutory authorisation with prior notification, and anonymisation where possible. This is the provision most often engaged by unsolicited marketing.
The rights — and the limit that matters most
Section 26 gives the data subject the right to:
- be informed of the use to which their personal data is put;
- access the personal data held about them;
- object to processing;
- have false or misleading data corrected; and
- have false or misleading data deleted.
Read that last right carefully. Kenya’s statutory erasure right under section 26(e) is confined to data that is false or misleading. There is no general right to be forgotten on the face of the section equivalent to Article 17 of the European regime.
This is the single most important nuance for anyone dealing with online exposure. A client whose accurate but unwanted personal information has been published cannot simply demand deletion under section 26 and expect the Act to supply the remedy. Advice that promises a general right of erasure is wrong, and it sets an expectation that cannot be met.
There are other routes to the same outcome — objection to processing under section 26(c), the principle of retention no longer than necessary under section 25(g), an absence of any lawful basis under section 30, and the constitutional petition discussed below — but they are different arguments and must be run as such.
Section 35 separately gives the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects the data subject.
Breach notification
Section 43 requires a controller to notify the Data Commissioner without delay, within seventy-two hours of becoming aware of a breach where there is a real risk of harm to the data subject. A processor must notify the controller within forty-eight hours. The 48-hour processor limb is regularly omitted from compliance summaries and is a common gap in processor contracts.
Cross-border transfers
Section 48 permits transfer out of Kenya where appropriate safeguards are proved to the Commissioner, where the destination has commensurate data protection laws, or where the transfer is necessary for contract performance, public interest, legal claims, vital interests or compelling legitimate interests. Section 49 imposes a stricter rule for sensitive personal data, requiring the data subject’s consent and confirmation of appropriate safeguards, and empowering the Commissioner to require a demonstration of effectiveness and to prohibit or suspend transfers.
Complaints and enforcement
Section 56 allows an aggrieved data subject to lodge a complaint with the Commissioner orally or in writing, and provides for the Commissioner to investigate and conclude within ninety days. The complaint costs nothing to file, and the timeline compares well with litigation.
The ninety days should not, however, be treated as a settled service guarantee. Kenyan High Court decisions have taken conflicting views of the provision: one line treats it as a hard deadline running from receipt, such that a determination made outside it is a nullity; another holds that the period runs only once the Commissioner admits the complaint for investigation, and that enforcement steps fall outside it altogether. Neither binds the other. A client planning around the deadline should be told that its effect is contested.
Section 58 provides for an enforcement notice, which must specify the provision contravened, the remedial steps required, an implementation period of not less than 21 days, and appeal rights. Section 62 provides for a penalty notice.
Section 63 sets the maximum administrative fine at KES 5 million, or in the case of an undertaking up to one per cent of its annual turnover of the preceding financial year, whichever is lower.
Note the formula. It is “whichever is lower” — the inverse of the European approach, and it operates as a cap rather than an escalator. Commentary that describes Kenyan penalties as turnover-based in the European sense is misleading.
A Data Protection (Amendment) Bill has been before Parliament which would, among other things, reverse that formula to “whichever is higher” and widen the section 26 rights. It had not been enacted when this article was last reviewed. Anyone relying on either the penalty ceiling or the scope of the erasure right should check whether it has since passed.
Section 65 provides for compensation to a person who suffers damage, with the controller liable for damage caused by processing and the processor liable only for breach of processor-specific obligations or for acting outside instructions. Sections 72 and 73 create offences, with a general penalty of a fine up to KES 3 million or imprisonment up to ten years, or both.
The regulations, and who must register
Three sets of regulations were made in 2021: the Data Protection (General) Regulations (Legal Notice 263), the Data Protection (Complaints Handling Procedure and Enforcement) Regulations (Legal Notice 264), and the Data Protection (Registration of Data Controllers and Data Processors) Regulations (Legal Notice 265).
Registration is required unless both conditions are met: annual turnover or revenue below KES 5 million and fewer than ten employees. Even below that threshold, registration is mandatory for entities engaged in political canvassing; crime prevention and prosecution; gambling; health administration and patient care; hospitality, excluding tour guides; property management and land sales; financial services; telecommunications; direct marketing; transport services including ride-hailing; operating an educational institution; and the processing of genetic data.
A small business that assumes it is exempt because of its size may well be caught by the sectoral list. A small private school is the obvious example, and — as the enforcement discussed below shows — schools have not been treated leniently.
Enforcement in practice
The ODPC has issued penalty notices in matters that map directly onto online exposure. In September 2023 it announced three penalties totalling KES 9,375,000: KES 2,975,000 against a digital credit provider for using complainants’ names and contact information obtained from third parties to send threatening messages and calls; KES 1,850,000 against a restaurant for posting a customer’s image on its social media without consent; and KES 4,550,000 against a school for posting minors’ pictures without parental consent, described at the time as the first and highest penalty against an educational facility.
The restaurant determination is the one to hold in mind. Publishing an identifiable person’s image on a commercial social media account, without consent, is unlawful processing in Kenya and has been penalised as such. That is a materially quicker and cheaper route than a defamation claim, and it does not require the publication to be false.
The ODPC publishes its determinations by year on its website, and the volume has grown substantially. Where a determination is to be relied on, the individual determination should be read rather than a press summary.
The constitutional route beside the Act
Article 31 of the Constitution protects the right to privacy directly, including the right not to have information relating to family or private affairs unnecessarily required or revealed, and not to have the privacy of communications infringed.
A constitutional petition under Articles 22 and 23 is a separate route from a complaint under the Act, and it has two features that matter:
- It is not subject to the Limitation of Actions Act, although unreasonable delay remains a discretionary bar. Where a defamation claim is time-barred at twelve months, a privacy petition may not be.
- It can reach systemic failures rather than a single act of processing. Kenyan courts have treated Article 31 as imposing a positive duty on those holding personal data, rejecting the argument that the wrongdoing of an individual employee absolves the organisation.
Choosing between the ODPC complaint, a constitutional petition and a claim in tort is a strategic decision with different costs, timelines, remedies and evidential burdens. It is worth making deliberately rather than by default.
It describes the law as understood at the date of review and does not take account of your circumstances. Law and platform practice both change. Reading it does not create an advocate–client relationship with JM Sons Advocates. Before acting or deciding not to act, take advice on your own facts.