PrivacyTerrain

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

medium confidence, Requires a more detailed pass on transfer and registration mechanics.

At a glance

Key presentation points

A compact summary of high-signal fields before the full structured record.

Effective statusin-force1 primary + 1 secondary • Reviewed 17/04/2026

Territorial scopeApplies to processing in Kenya and, in some circumstances, processing by controllers or processors outside Kenya that handle data of persons in Kenya.1 primary + 1 secondary • Reviewed 17/04/2026

Regulator or enforcement authority summaryOffice of the Data Protection Commissioner1 primary • Reviewed 17/04/2026

Requires legal basisYes1 primary + 1 secondary • Reviewed 17/04/2026

Structured record

Regulation details grouped by topic

Each value keeps its field context, linked sources, notes, and review date together to avoid detached or ambiguous statements.

Identity

Effective status: in-forceSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Law status: activeSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Effective date: 2019-11-25Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Last amended: 2022-09-14Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Scope

Extraterritorial application: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Territorial scope: Applies to processing in Kenya and, in some circumstances, processing by controllers or processors outside Kenya that handle data of persons in Kenya.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Private sector coverage: Applies broadly to private-sector data controllers and processors.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Public sector coverage: Public entities are also subject to the framework.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Definitions

Personal data definition: Personal data means any information relating to an identified or identifiable natural person.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Sensitive data recognized: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Legal Basis

Legal bases: consent, contract, legal obligation, public interest, legitimate interestsSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Requires legal basis: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Rights

Right of access: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to deletion: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to object: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to portability: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to appeal: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Right to erasure or delete summary: Deletion rightsSupport: 1 primary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary)Note: Kenya's data protection framework includes deletion-oriented rights in a relatively modern form.
Right to rectification or correction summary: Rectification rightSupport: 1 primary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary)Note: Kenya includes correction-related rights within its national privacy regime.

Breach

Breach deadline (hours): 72Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Breach notification required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Governance

DPO required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Impact assessment required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Records of processing required: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Enforcement

Maximum fine: The ODPC can issue enforcement notices and meaningful financial penalties for violations.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Private right of action: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Regulator or enforcement authority summary: Office of the Data Protection CommissionerSupport: 1 primary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary)Note: Kenya's privacy oversight centers on the ODPC.

Transfers

Cross-border transfer restricted: YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.
Data localization required: NoSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Marketing

Cookie consent rule: Cookie and tracking obligations are shaped by consent, fairness, and purpose limitation requirements.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: Kenya Data Protection Act text (primary); ODPC guidance (secondary)Note: Seeded as part of the MEA/Africa expansion wave. Requires follow-up editorial review.

Official sources

Kenya Data Protection Act textPrimary official law • en • html
ODPC guidanceSecondary official material • en • html

Kenya