Data protection laws in Kenya
The Data Protection Act, 2019 (the “Act”) came into force on 25th November, 2019 and is now the primary statute on data protection in Kenya. It gives effect to Article 31 c) and d) of the Constitution of Kenya, 2010 (right to privacy).
In October 2020, by virtue of the powers conferred to him under the Act, the Cabinet Secretary for Information, Communication, Technology, Innovation and Youth Affairs gazetted the Data Protection (Civil Registration) Regulations, 2020 (the “Regulations”). The Regulations apply to civil registries involved in processing personal data for registrations such as births, deaths, adoptions, persons, passports and marriages.
Since the Data Protection Commissioner’s (DPC) appointment on 16 November 2020, significant efforts have been made in developing regulations for the implementation of the Act.
- Data Protection (Complaints Handling Procedure & Enforcement) Regulation, 2021 (the “Complaints Handling Regulations”) - sets out the complaints handling procedures and enforcement mechanisms in the event of non-compliance with the provisions of the Act;
- Data Protection (Registration of Data Controllers & Data Processors) Regulations, 2021 (the “Registration Regulations”) - provides for the registration of data controllers and data processors with the Office of the Data Protection Commissioner (ODPC). The threshold for mandatory registration is also set out under these regulations; and
- Data Protection (General) Regulations, 2021 (the “General Regulations”) – elaborates in more detail the rights of data subjects, restrictions on commercial use of personal data, duties and obligations of data controllers and data processors, elements of implementing data protection by design or default, notification of personal data breaches, transfer of personal data outside Kenya, conduct of data protection impact assessment and other general provisions.
The above regulations were gazetted in January and came into effect on 14 February 2022 with the exception of the Registration Regulations, 2021 which came into force on 14 July 2022.
The ODPC has also issued a number of guidelines, these include:
- Guidance Note on Registration of Data Controllers and Data Processors - developed to assist entities in ascertaining if they are data controllers or data processors, and to understand their obligations with respect to mandatory registration;
- Guidance Note on Processing Personal Data for Electoral Purposes - developed to assist data controllers and data processors dealing with voters’ personal data and members of political parties’ personal data to understand their obligations under the Act;
- Guidance Note on Data Protection Impact Assessment - to assist data controllers and data processors to understand their obligations under the Act and the need to undertake a Data Protection Impact Assessment;
- Guidance Note on Consent - developed to assist data controllers and data processors to understand their duties under the Act and their obligations as far as obtaining consent is concerned;
- Guidance Note for the Communications Sector – it applies to communication service providers processing personal data in either the public or private sectors and provides considerations that must be present in when processing subscribers’ personal data, network traffic, location or geographical data, financial data, and mobile operators’ privacy policies;
- Guidance Note for the Education Sector – developed to assist educational institutions to understand their obligations under the DPA and remain compliant. The guidance note also covers institutions offering remote e-learning solutions and services;
- Guidance Note on the Processing of Health Data – developed to provide healthcare institutions with a clear understanding of their obligations under the DPA and applies to all healthcare institutions operating in Kenya, including hospitals & clinics, laboratories, pharmaceutical services, health insurance providers, health research and training institutions, and professional health bodies. The guidance note also extends to the processing of digital health processing platforms such as Health Management Information System (HMIS), eHealth and mHealth applications; and
- Guidance Note for Digital Credit Providers – sets out the compliance requirements that digital credit providers (DCPs) must implement while processing personal data in line with the administration of digital credit and in compliance with the DPA.
- Guidance Notes for the Public Sector – Developed to provide the public sector with a clear understanding of their obligations under the Act and Regulations, and to guide public entities in ensuring legal compliance, upholding privacy rights, and protecting against various risks that come with processing of personal data;
- Guidance Notes on Processing by Micro, Small & Medium Enterprises (MSMEs) – developed to assist MSMEs understand their obligations under the Act, the scope of their data processing activities, and to help them implement best practices for data protection while promoting compliance with the Act;
- Guidance Notes on Processing for Journalistic Purpose – developed to clarify the balance between freedom of expression and personal data protection in journalistic, literary and artistic activities. It outlines the scope of allowable exemptions under the DPA, emphasizing that these exemptions are not absolute and must satisfy the specific conditions set out in the Act, and further outlines the compliance requirements and obligations;
- Guidance Notes on Processing for Research Purpose – developed to provide the considerations that must be present when processing personal data for research purposes;
- Guidance Notes for Processing Children’s Data – developed to set out considerations that must be present when processing children’s personal data, and to clarify the obligations of organisations that process children’s data;
- Guidance Notes on Biometric Data – provides detailed considerations that must be taken into account when processing biometric data, and to clarify the legal and compliance obligations of data controllers and data processors when processing biometric data;
- Guidance Notes on Historical & Statistical Purposes – developed to outline the obligations of data controllers and processors regarding the processing of personal data for historical and statistical purposes; and
- Guidance Notes for Processing of Personal Data on Publications of Recorded Media – addresses the processing of personal data for the publication of audio visual and recorded media, with the exclusion of intellectual property rights considerations. It outlines specific considerations and best practices and provides direction in the handling of personal data within the context of creating, processing and publishing audio visual content, ensuring compliance with the Act and Regulations when processing personal data for publication of recorded media.
The ODPC has also published:
- the Personal Data Protection Handbook, which provides simplified information to data controllers and data processors, who have the responsibility and obligation to uphold the principles of data protection, and acts as an awareness wallet for data subjects to better understand their rights and available legal and institutional framework to protect their personal data from processing that is not covered under the existing personal data laws;
- the Data Without Borders Report, which highlights how trusted data flows can power Kenya’s economic growth. This report on the economic impact of data flows provides timely and evidence-based analysis to support the implementation of the Act. It examines how data flows contribute to economic growth, innovation, and competitiveness, while also highlighting the role of effective data governance, regulatory certainty, and trust;
- a Complaints Management Manual, which sets out the complaints management handling procedure by the ODPC;
- the Alternative Disputes Resolution Framework/Guidelines, which provide guidance to stakeholders who wish to engage in Alternative Dispute Resolution (ADR) to resolve their disputes arising under the Act;
- the Data Sharing Code, which provides a framework for responsible and ethical data sharing practices and outlines the requirements that data controllers and processors are required to observe prior to sharing personal data, as well as the measures to put in place to ensure the protection of the data subject.
The ODPC is also in the process of developing the following regulations, which are currently undergoing public consultation/participation:
- Data Protection (Conduct of Compliance Audit) Regulations, 2024 – set out the procedure for the conduct of audits by the ODPC, as well as the procedure for entities that want to be accredited by the ODPC to carry out data protection audits; and
- Guidance Note on the Processing of Personal Data for Private Security – provides clear and concise instructions on how to handle personal data by the private security service providers in Kenya, in accordance with the Act and the Regulations. Also provides practical advice on how to implement appropriate technical and organizational measures to protect personal data from unauthorized access, disclosure, alteration, or destruction.
