The transfer of personal data outside Kenya is highly regulated under the Act (Part VI of the Act). Prior to any transfer the data controller or data processor must provide proof to the DPC on the appropriate safeguards with respect to the security and protection of the personal data including jurisdictions with similar data protection laws. The data controller also has an obligation to document the transfer and provide documentation to the DPC upon request.

The consent of the data subject is required for the transfer of sensitive personal data out of Kenya.

Under the Regulations, civil registration registries cannot transfer personal data collected for civil registration purposes outside Kenya without the written approval of the DPC.

The General Regulations elaborate in more detail transfer of personal data outside Kenya. They provide for four legal bases for the transfer of personal data out of the country, which include:

1. appropriate data protection safeguards in the country or territory in which recipient is based. Any country or territory is taken to have appropriate safeguards if it has: a reciprocal data protection agreement with Kenya; ratified the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention); or contractual binding corporate rules among a concerned group of undertakings or enterprises;
2. adequacy: an adequacy decision made by the DPC that the country, territory or the international organization to which/whom data is being transferred ensures an adequate level of protection of personal data;
3. necessity: transfer is deemed to be necessary if it is:
   • for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject before entering into a contract;
   • for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another person;
   • for any matter of public interest;
   • for the establishment, exercise or defence of a legal claim in order to protect the vital interests of the data subject or of other persons, where the data subject is physically or legally incapable of giving consent; or
   • for the purpose of compelling legitimate interests pursued by the data controller or data processor which are not overridden by the interests, rights and freedoms of the data subjects; or
4. consent of the data subject, on the condition they have consented to the proposed transfer and have been informed of the possible risks of transfer.