info@nexoprivacy.com +254 768200243 Mon - Sat | 24 Hours
Admin
Home Policies Kenya Data Protection Act, 2019
Africa · Kenya

Kenya Data Protection Act, 2019

Kenya's flagship data protection statute, enforced by the Office of the Data Protection Commissioner (ODPC).

Quick facts

  • Code: DPA-KE
  • Jurisdiction: Kenya
  • Region: Africa
  • Enforcement:
    Administrative fines up to KES 5M or 1% of annual turnover (whichever is lower)
  • Official source
Get help with DPA-KE Free site scan

The Kenya Data Protection Act, 2019 and its Regulations (General, Compliance & Enforcement, Registration) establish duties for controllers and processors, registration thresholds, data-subject rights and cross-border-transfer rules.

NexoPrivacy delivers ODPC registration, DPIAs, Data Protection Impact Assessments, complaints handling and operator-controller-agreement frameworks - all aligned with Kenyan and international best practice.

Key principles & obligations

Lawfulness, fairness & transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity & confidentiality
Accountability
Cross-border transfer safeguards
More in Africa

Related frameworks.

South Africa

Protection of Personal Information Act (POPIA)

South Africa's comprehensive privacy law, enforced by the Information Regulator.

Read summary
Nigeria

Nigeria Data Protection Act (NDPA) 2023

Nigeria's comprehensive privacy law, enforced by the Nigeria Data Protection Commission (NDPC).

Read summary
Kenya

Kenya Computer Misuse and Cybercrimes Act, 2018

Criminalises cyber-offences and gives effect to investigation, prosecution and international cooperation on cybercrime in Kenya.

Read summary