Data Protection in Kenya

Electronic marketing in Kenya

Section 37 of the Act

The use of personal data for commercial purposes is prohibited unless the person undertaking this processing:

  • has sought and obtained express consent from a data subject; or
  • is authorized to do so under any written law and the data subject has been informed of such use when collecting the data from the data subject.

The General Regulations states that a data controller or data processor is considered to be using personal data for commercial purposes if the personal data of a data subject is used to advance commercial or economic interests, including inducing another person to buy, rent, lease, join, subscribe to, provide or exchange products, property, information or services, or enabling or effecting, directly or indirectly, a commercial transaction.

The General Regulations further include circumstances where the personal data is used for direct marketing through:

  • sending of a catalogue through any medium addressed to a data subject;
  • displaying an advertisement on an online media site where a data subject is logged on using their personal data; or
  • sending an electronic message to a data subject about a sale, or other advertising material relating to a sale, using personal data provided by a data subject.

An exception to direct marketing restrictions is provided where the personal data is not used or disclosed to identify or target a particular recipient.

Personal data other than sensitive personal data is only permitted to be used for direct marketing where:

  • the data controller or data processor has collected the personal data directly from the data subject;
  • a data subject is notified that direct marketing is one of the purposes for which personal data is collected;
  • the data subject has consented to the use or disclosure of the personal data for the purpose of direct marketing;
  • the data controller or data processor provides a simplified opt-out mechanism for the data subject to request not to receive direct marketing communications; or
  • the data subject has not made an opt-out request.

The Cabinet Secretary in charge of information, communication and technology may, in consultation with the DPC, develop guidelines on the commercial use of personal data.

Back to top