As we move further into the digital age, the protection of personal data has become a critical concern for individuals, businesses, and governments alike. Kenya’s comprehensive Data Protection Act, 2019 (DPA), provides a legal framework for managing and protecting personal data. This article outlines key aspects of data protection in Kenya for 2025, helping businesses and individuals navigate their obligations, rights, and best practices in a constantly evolving landscape.

Introduction to the Data Protection Act, 2019

Enacted in November 2019, the Data Protection Act (DPA) was a landmark piece of legislation aimed at safeguarding the privacy and integrity of personal data. Inspired by global data protection regulations such as the EU’s General Data Protection Regulation (GDPR), the Act ensures that data subjects’ rights are protected and that data controllers and processors adhere to strict standards when processing personal information.

In 2025, data protection remains a top priority for businesses in Kenya, especially in light of continued digital transformation. With the rise of data breaches, online surveillance, and growing concerns about digital privacy, compliance with the DPA is crucial for companies operating in Kenya.

Recent Penalties Under the Data Protection Act

In 2023, several companies faced substantial penalties for violating Kenya’s Data Protection Act, underlining the importance of compliance with data privacy laws:

• Mulla Pride Ltd: A digital credit provider was fined KES 2,975,000 for misusing personal data obtained from third parties. They used this data to send threatening messages and make harassing phone calls, violating the rights of individuals. The penalty emphasizes the necessity of obtaining explicit consent before collecting and processing personal data.
• Casa Vera Lounge: The restaurant was fined KES 1,850,000 for posting a customer’s image on social media without consent. This case highlights the need for businesses, especially in the hospitality sector, to secure customer consent before sharing images online.
• Roma School: The educational institution faced a fine of KES 4,550,000 for posting images of minors without obtaining parental consent. This serves as a critical reminder for schools and institutions handling minors’ personal data to seek parental approval before processing such data.

These penalties were issued under the authority of the Data Protection Act, 2019, reinforcing the need for organizations to follow proper procedures when collecting, processing, and sharing personal data.

Who is Affected by the Data Protection Act?

The DPA applies to all entities (both local and foreign) processing personal data in Kenya. It defines personal data as any information that can be used to identify an individual, such as names, ID numbers, health information, and contact details.

The Act applies to:

• Data Controllers: Entities that determine the purpose and means of processing personal data.
• Data Processors: Entities that process data on behalf of the data controller, often for specific tasks like data storage or analysis.

The DPA’s reach extends beyond Kenyan borders, ensuring that any entity processing personal data of Kenyan citizens, regardless of their location, complies with the Act’s requirements. This extra-territorial scope means that companies outside Kenya must align their data practices with Kenyan law if they handle data belonging to Kenyan residents.

Key Principles of Data Processing

Data processing in Kenya must adhere to several core principles under the DPA, ensuring that data is handled responsibly, fairly, and in a manner that respects the privacy of individuals:

• Lawfulness, Fairness, and Transparency: Data should be processed legally, fairly, and transparently.
• Purpose Limitation: Personal data must be collected for specific, legitimate purposes and not processed for unrelated objectives.
• Data Minimization: Only the necessary amount of personal data should be collected.
• Accuracy: Personal data must be accurate and kept up to date.
• Storage Limitation: Personal data should not be retained longer than necessary.
• Integrity and Confidentiality: Data must be secured and protected from unauthorized access or disclosure.

Rights of Data Subjects

Kenyan citizens enjoy several rights under the DPA that protect their personal data. These rights ensure individuals have control over their data:

• Right to Access: Data subjects can request access to their personal data held by a controller or processor.
• Right to Correction: If data is inaccurate, individuals can request it be corrected.
• Right to Deletion: Data subjects can request the deletion of their data if it’s no longer needed or if it was collected unlawfully.
• Right to Object: Individuals can object to the processing of their data, especially for direct marketing purposes.
• Right to Withdraw Consent: If consent is the basis for processing, data subjects can withdraw it at any time.

Data Protection Obligations for Businesses.

Businesses handling personal data in Kenya must implement several measures to ensure compliance with the DPA, including:

• Registering with the Data Protection Commissioner: Data controllers and processors are required to register with the Data Protection Commissioner (DPC) before processing personal data.
• Data Protection by Design and by Default: Businesses must integrate data protection measures into their systems and processes from the outset.
• Data Protection Impact Assessments (DPIAs): Businesses must conduct DPIAs for processing activities that could significantly impact privacy.
• Security Safeguards: Companies must implement physical, technical, and organizational measures to protect data from breaches.
• Data Retention Policies: Personal data should only be kept for as long as necessary, and companies must establish clear policies on data retention and destruction.

Transfer of Personal Data Outside Kenya

The DPA regulates the transfer of personal data outside Kenya. Businesses must ensure that personal data is only transferred to jurisdictions that offer adequate protection. If transferring data abroad, the data controller or processor must:

• Obtain the data subject’s consent for the transfer.
• Provide proof of adequate safeguards in the destination country.
• Ensure the transfer is necessary for specific purposes, such as fulfilling a contract or protecting vital interests.

The DPA includes specific provisions for sensitive data (e.g., health data), which requires explicit consent.

Enforcement and Penalties

The Data Protection Commissioner (DPC) enforces compliance with the Act. The DPC has the power to investigate complaints, conduct audits, and issue penalties for non-compliance. Penalties include:

• Fines: Up to KES 5 million or 1% of annual turnover, whichever is lower.
• Imprisonment: Up to 10 years, depending on the severity of the violation.
• Equipment Forfeiture: Courts may order the confiscation of equipment used in breaches.

To avoid these penalties, businesses must ensure full compliance with the DPA and quickly address any data breaches or violations.

Exemptions

There are a few exemptions to the DPA, such as:

• National Security: Personal data processing may be exempt if related to national security or public interest.
• Journalism, Literature, and Art: Some activities may not require full compliance to preserve freedom of expression.
• Public Authorities: Government bodies may process personal data without consent for legal obligations or public tasks.

The Future of Data Protection in Kenya

Looking ahead to 2025, businesses must stay abreast of developments in data protection. As Kenya continues to integrate more digital systems, businesses will need robust data protection practices to ensure compliance with the DPA.

With the eventual establishment of more regulatory frameworks, organizations should consider appointing data protection officers. This will ensure compliance and help build trust with customers who are increasingly concerned about their personal data.

Conclusion

Data protection in Kenya will continue to be a vital concern for businesses and individuals. By understanding and adhering to the DPA’s requirements, businesses can avoid penalties, enhance customer trust, and navigate the complexities of data privacy in the digital age.

For businesses looking to ensure full compliance, expert legal advice and practical guidance are essential. Reach out to our team at WeComply Labs to discuss how we can help your organization align with Kenya’s data protection regulations and build a secure, transparent data management system for the future.