--- title: "Kenya Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/kenya-data-protection-privacy-regulation/ source_html: /jurisdictions/kenya/index.html description: "Kenya data protection and privacy regulation: 10 categories, 93 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: cd6d96ee4c60fcac77ae43783d3f1c60227d91cf3c1d8296857cd2c2ae09ccb8 generator: "fe-fleet/md-twin@1.0" --- # Kenya Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Kenya Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed in transition overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/kenya/), [World Payments](https://payments.gi/jurisdictions/kenya/), artificial-intelligence, [Crypto](https://cryptoassets.gi/jurisdictions/kenya/) Last updated 2026-11-04 · 10 categories · 93 claims · 37 sources in the cumulative register Download report (PDF) Expand all Kenya's data-protection enforcement posture has escalated sharply into 2026. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Cross-Border & Adequacy, Children & Vulnerable Groups, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=KENYA)[Build Report](/reports/?j=KENYA)[Compare](/compare/?j=KENYA) Framework posture In transition 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Office of the Data Protection Commissioner (ODPC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 93 Claims 1 Tier-1 sources Traffic-light mix 9 amber 1 green (sums to 10 rendered categories; click to filter) No red categories; 20 sub-modules are flagged red. ## Jurisdiction brief Jurisdiction lead brief 1,163 Full executive summary 352 ###### Latest update · 4 November 2026 #### Lead Signal Kenya's data protection authority has issued new guidance that materially raises the compliance bar for any organisation whose data processing touches servers outside the country. The Office of the Data Protection Commissioner's Cross-border Data Transfer Guidance confirms that storing or processing personal data in a cloud environment hosted outside Kenya, including routine backups and access by a group's head office, counts as a cross-border transfer in its own right and therefore requires a lawful basis for that transfer to proceed. For sensitive personal data that cannot satisfy the applicable transfer test, the guidance goes further: it requires that the data be processed through a Kenyan-located data centre, or that at least one serving copy be kept in Kenya. This is a practical localisation fallback dressed as a transfer-mechanism rule, and it will be felt most by multinational controllers that have historically treated regional or global cloud infrastructure as a back-office detail rather than a compliance question requiring a Kenya-specific lawful basis. #### Other Developments Alongside the transfer guidance, there is a parallel and still-unresolved thread on adequacy. The European Commission indicated in June 2026 that it welcomed progress in its adequacy dialogue with Kenya and noted a positive assessment so far, but no adequacy decision has been concluded. Kenyan law itself does not prohibit cross-border transfers outright; the new guidance instead builds a structured set of conditions around when and how such transfers are lawful, which sits more comfortably alongside an eventual adequacy finding than a blanket restriction would. #### Cross-Monitor Connections None identified. #### Outlook The practical question for the months ahead is less about Kenyan law's direction, which is clearly toward more structured control of outbound data flows, and more about how the localisation fallback for sensitive data will be interpreted and enforced in practice. If the European Commission's adequacy dialogue concludes on a positive note, it would ease compliance for EU-linked transfers specifically, but would not on its own resolve the separate localisation requirement that now attaches to the broader category of sensitive personal data failing the transfer test under the ODPC's framework. 5 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Kenya's data-protection enforcement posture has escalated sharply into 2026. The Office of the Data Protection Commissioner has moved from an awareness-building phase into a structured regime of regulator-led audits, compensation orders and court-enforced deletion mandates. The clearest evidence of this shift is quantitative: in January 2026 alone, the ODPC issued 184 compensation orders, part of a broader enforcement record that includes over 9,061 complaints received, 357 determinations, 134 enforcement notices and 20 penalty notices. This places Kenya among the more active data-protection enforcement regimes on the African continent by volume, a materially different posture from the Office's earlier awareness-led approach. This enforcement intensification sits alongside a standing structural feature of the Act: the Data Protection Act, 2019 applies extraterritorially to any organisation processing the personal data of individuals located in Kenya, regardless of where that organisation is based, capturing foreign companies that offer goods or services to, or monitor, Kenyan residents. Combined with the ODPC's newly assertive enforcement posture, that extraterritorial reach means foreign-domiciled organisations serving Kenyan users can no longer treat Kenya's data-protection regime as a low-enforcement-risk jurisdiction. #### Other Developments A pending amendment bill would raise financial exposure. The Data Protection Act, 2019's administrative penalty ceiling currently allows the ODPC to impose a fine of up to KES 5 million or 1% of annual turnover, whichever is lower; the Data Protection (Amendment) Bill 2025 proposes flipping this calculation to whichever is higher, which would substantially increase exposure for large organisations. The same bill would broaden standing to file complaints beyond data subjects to any person, and would expand the categories of sensitive data to include political opinions and trade union membership, aligning Kenya's special-category regime more closely with the structure of GDPR Article 9. None of these amendments are yet enacted. Data subject rights await a dedicated appeals forum. The same Amendment Bill 2025 would establish a Data Protection Appeals Tribunal required to resolve complaints within 60 days, a potentially significant improvement in redress speed relative to the current complaints pathway through the ODPC itself, though this too remains pending enactment. A parallel cybersecurity regime has been assented. The Computer Misuse and Cybercrimes (Amendment) Act 2024, assented 15 October 2025, targets SIM-swap fraud, phishing, identity theft and online harassment, and adds a parallel cybersecurity regime alongside the Data Protection Act 2019, including a tighter 24-hour breach-notification clock for critical-infrastructure operators, distinct from the Data Protection Act's own 72-hour controller and 48-hour processor notification windows. Biometric governance is contested from two directions at once. A Kenyan court ordered the deletion of biometric data that had been collected without a sufficient lawful basis, one of the most significant judicial enforcement actions taken under the Data Protection Act 2019 to date. At the same time, the Kenya Information and Communications (Amendment) Bill 2025, under parliamentary review as of May 2026, would empower the Cabinet Secretary to mandate that internet service providers install real-time surveillance tools, and would separately require ISPs to assign each subscriber a unique trackable meter number tied to detailed personal data submitted to the Communications Authority of Kenya. Civil-society body ICJ Kenya has described the Bill as a potential vehicle for mass surveillance. #### Cross-Monitor Connections The Kenya Information and Communications (Amendment) Bill 2025's subscriber-tracking and surveillance-tooling provisions sit at the intersection of this monitor's algorithmic and surveillance-governance coverage and the world-payments monitor's tracking of Kenya's telecommunications-adjacent financial infrastructure, to the extent that subscriber identity data increasingly underpins mobile-money authentication; that payments-infrastructure angle is not analysed independently here. The Computer Misuse and Cybercrimes (Amendment) Act's tighter 24-hour breach clock for critical-infrastructure operators additionally overlaps with sector-specific obligations that financial-sector regulators impose on banks and payment providers, an intersection this brief flags without analysing the payments-regulatory detail, which sits outside this monitor's scope. Separately, financial-integrity's coverage of Kenya's beneficial-ownership and virtual-asset-service-provider obligations touches data-handling questions, such as customer due-diligence data retention, that are adjacent to but distinct from the controller/processor duties addressed in this brief. #### Outlook The Data Protection (Amendment) Bill 2025 is the single most consequential pending development to track: its enactment, expected around the first quarter of 2027, would simultaneously raise ODPC's penalty ceiling, broaden complaints standing, expand special-category data, and establish a new Appeals Tribunal required to resolve complaints within 60 days. On a shorter horizon, the Kenya Information and Communications (Amendment) Bill 2025's progress through Parliament, expected to develop over the next two quarters, is the marker to watch for whether Kenya's surveillance-governance trajectory tilts toward the mass-surveillance model civil society has warned against, or is moderated during the legislative process. The court's biometric-deletion order stands, for now, as a counterweight demonstrating that judicial enforcement under the existing Act remains active even as the legislative surveillance debate continues. Read full brief · 1163 words ###### Latest update · 28 September 2026 #### Regulatory Status Kenya's data-protection regime is understood to have shifted in 2026 from an awareness-and-voluntary-compliance posture toward a more operationalised enforcement environment, with the Office of the Data Protection Commissioner conducting audits, issuing compensation orders, and a court reportedly ordering deletion of unlawfully collected biometric data. The ODPC determined 96 complaints in 2025 under penalties of up to KES 5 million or 1% of annual turnover, and the High Court upheld the ODPC's findings in Regus Kenya Limited v Data Protection Commissioner [2025] eKLR while moderating the penalty for a first-time offender. New ODPC Guidance Notes for Cross-Border Data Transfers were issued in 2026, and Kenya's Data Protection Act's close alignment with the GDPR is reported to support Kenya's position in an ongoing, unconcluded EU adequacy dialogue. A Data Protection Amendment Bill, reported to propose expanded ODPC penalty powers and a draft Artificial Intelligence Bill 2026 modelled in part on the EU AI Act, both remain at uncertain or proposed legislative stages. #### Outlook The legislative fate of both the Data Protection Amendment Bill and the draft Artificial Intelligence Bill 2026 are the central open questions for Kenya's data-protection trajectory, alongside the unresolved status of the Kenya-EU adequacy dialogue launched in May 2024. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Kenya's data-protection regime is tightening across institutional, sectoral and enforcement dimensions simultaneously. The ODPC has moved into active enforcement, issuing 184 compensation orders in January 2026 alone against a backdrop of over 9,061 complaints and 134 enforcement notices. A pending Amendment Bill would raise penalty exposure, broaden complaints standing and expand special-category data, while a newly assented cybercrime law adds a parallel 24-hour breach-notification regime for critical infrastructure. Biometric governance is contested: a court ordered deletion of unlawfully collected biometric data even as a pending telecommunications bill would expand state surveillance capability. #### Outlook The Amendment Bill's enactment and the telecommunications surveillance bill's parliamentary progress are the two developments most likely to reshape Kenya's data-protection posture over the coming cycles. Read full brief · 352 words Key regulatory facts for Kenya Regulatory Dimension Kenya Standing Position Jurisdiction Kenya (KE) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 93 sourced findings) Regulator & Framework Statute in force and regulator active/enforcing since 2021-2022, but core implementing instruments (SCC-equivalent forms, adequacy decisions) remain absent, and the ODPC's independence/resourcing has been publicly... Lawful Processing & Special Data Core lawful-basis and special-category framework is legislated and in force, closely tracking GDPR structure. Data Subject Rights Rights exist and are being enforced via ODPC orders, but the Act is comparatively thin on granular procedural mechanics/response deadlines for controllers. Controller/Processor Duties Core accountability, DPIA, and breach-notification duties are legislated and enforced, but DPO mandate is non-binding in practice and ROPA/joint-controller mechanics are comparatively underdeveloped versus GDPR. Primary Instruments Cited International Association of Privacy Professionals, OneTrust DataGuidance, OneTrust DataGuidance, OneTrust DataGuidance, Anyega Osiemo & Co. Advocates Last Confirmed / Updated 2026-11-04 (37 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Kenya: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Statute in force and regulator active/enforcing since 2021-2022, but core implementing instruments (SCC-equivalent forms, adequacy decisions) remain absent, and the ODPC's independence/resourcing has been publicly questioned. Primary framework Data Protection Act, 2019 (Kenya) Supervisory authority [Office of the Data Protection Commissioner (ODPC)](https://www.odpc.go.ke/) Traffic-light rationale — Amber Statute in force and regulator active/enforcing since 2021-2022, but core implementing instruments (SCC-equivalent forms, adequacy decisions) remain absent, and the ODPC's independence/resourcing has been publicly questioned. #### Sub-modules (5) #### Regulator And AuthorityAmber The ODPC, headed by the Data Protection Commissioner, oversees implementation and enforcement of the Act under Section 8; the first Commissioner was sworn in November 2020, more than a year after the Act commenced. Claims (5): - The Data Protection Commissioner oversees implementation and enforcement of the Act under Section 8, but the office remained unformed until Immaculate Kassait was sworn in as Kenya's first Data Commissioner on 16 November 2020. - The Office of the Data Protection Commissioner (ODPC) is Kenya's data-protection regulator, established under the Data Protection Act, 2019. - Office of the Data Protection Commissioner (ODPC) — In 2026 the ODPC moved beyond awareness campaigns and voluntary compliance into a structured regime of regulator-led audits, compensation orders and court-enforced deletion mandates. - Data Protection Act, 2019 — In force; establishes Office of the Data Protection Commissioner as supervisory authority - The Office of the Data Protection Commissioner, headed by Data Commissioner Immaculate Kassait, is Kenya's operational data-protection enforcement authority. #### Act And InstrumentsGreen The Data Protection Act, 2019 came into force 25 November 2019 as Kenya's primary DP legislation, supplemented by the Data Protection (General) Regulations, (Registration of Data Controllers and Data Processors) Regulations, and (Compliance and Enforcement) Regulations, all 2021. Claims (5): - The Data Protection Act, 2019 came into force on 25 November 2019 and is the primary data protection legislation in Kenya. - The Data Protection Act, 2019 gives effect to Article 31 of the Constitution of Kenya on the right to privacy. - Data Protection (Amendment) Bill, 2025 — Proposes changing the administrative-fine cap from 'whichever is lower' (KES 5m or 1% of annual turnover) to 'whichever is higher', expanding complaints access from 'data subject' to 'any person', and creating a Data Protection Appeals Tribunal - Data Protection (Amendment) Bill, 2025 — Proposes AI-governance, cross-border data-sharing and enhanced-penalty provisions; status not confirmed to a primary Gazette/National Assembly source - The Data Protection Act, 2019 (No. 24 of 2019) is Kenya's primary data-protection statute, giving effect to Article 31(c) and (d) of the Constitution. #### Material ScopeGreen The Act covers processing of 'personal data' and imposes enhanced rules on 'sensitive personal data', defined broadly to include race, health status, ethnic/social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (including children's/parents'/spouse's names), sex, and sexual orientation. Claims (1): - Sensitive personal data under the Act includes race, health status, ethnic/social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (names of children, parents, spouses), sex and sexual orientation. #### Territorial ScopeGreen The Act applies extraterritorially: it covers any controller/processor established or resident in Kenya processing data while in Kenya, and also any controller/processor not established in Kenya but processing personal data of data subjects located in Kenya. Claims (1): - The Act applies to controllers/processors established or resident in Kenya, and separately to controllers/processors not established or resident in Kenya but who process personal data of data subjects located in Kenya, giving it broader extraterritorial reach than the GDPR's establishment-based test. #### Regulator Registration And FilingAmber Section 18 prohibits acting as a controller/processor unless registered with the Data Commissioner; the Registration Regulations 2021 set turnover/employee-based exemption thresholds (below KES 5 million turnover or under 10 employees) but registration remains mandatory regardless of size for specified high-risk activities. Registration opened 14 July 2022. Claims (5): - Section 18 provides no person shall act as a data controller or data processor unless registered with the Data Commissioner, who prescribes mandatory-registration thresholds considering industry nature, data volumes processed, and whether sensitive personal data is processed. - The Registration Regulations exempt controllers/processors with annual turnover below KES 5 million or fewer than 10 employees from registration, but registration remains mandatory regardless of size for specified high-risk processing activities; online/physical registration opened 14 July 2022. - Section 63 of the Data Protection Act, 2019 empowers the Data Commissioner to impose an administrative fine of up to KES 5 million or 1% of the preceding year's annual turnover, whichever is lower. - Office of the Data Protection Commissioner (ODPC) — ODPC operates a public registration portal and register of data controllers and processors used, among other things, as a basis for risk-based audit selection. - Office of the Data Protection Commissioner — ODPC has intensified enforcement of mandatory registration for data controllers/processors in 2026, with non-compliance risking fines of up to KES 5,000,000 Kenya's Data Protection Act, 2019 (DPA) is the primary omnibus instrument, enacted to give effect to the constitutional right to privacy under Article 31(c) and (d) of the Constitution. It closely mirrors GDPR concepts but substitutes GDPR-style record-keeping (Art 30 ROPA) with a mandatory registration/certification regime for controllers and processors. The Office of the Data Protection Commissioner (ODPC) was formally activated only after the first Commissioner, Immaculate Kassait, was sworn in on 16 November 2020 -- over a year after the Act's commencement -- and the operative subsidiary regulations (General, Registration, and Compliance & Enforcement Regulations) were only finalised in 2021 with registration opening in July 2022. The regime is therefore treated as in_transition: the statute and ODPC are operative and actively enforcing, but several implementing mechanisms (e.g. approved SCC-equivalents, formal adequacy determinations) remain undeveloped. Periodic update · new data 2026-10-11 #### Regulator & Framework The Office of the Data Protection Commissioner has intensified enforcement of mandatory registration for data controllers and processors through 2026, with organisations that fail to register risking fines of up to KES 5,000,000. This registration push is an enforcement-posture development layered on top of a standing registration requirement rather than a new statutory obligation. Alongside this enforcement intensification, the Data Protection (Amendment) Bill, 2025 is pending before Parliament, proposing three distinct changes to the framework: reversal of the administrative fine cap from the current formula of KES 5,000,000 or 1% of annual turnover, whichever is lower, to a new formula of whichever is higher; expansion of who may bring a complaint from "data subject" to "any person"; and the creation of a Data Protection Appeals Tribunal as a dedicated forum for challenging the Commissioner's decisions. The Bill has not been enacted, and its current parliamentary status was not confirmed this cycle. If enacted as proposed, the fine-cap reversal would represent a materially more punitive penalty structure than the one currently in force, since the "whichever is higher" formula removes the ceiling effect that the lower-of-two-figures test currently provides for organisations with substantial annual turnover. #### Outlook The trajectory for this module is tightening on two fronts simultaneously: ODPC's own enforcement intensity against unregistered controllers and processors, and the legislative proposal to raise the ceiling on penalties available once a breach is established. Whether the Amendment Bill proceeds to enactment, and on what timeline, is the open question carried forward. 1 earlier distinct update(s) Periodic update · new data 2026-09-28 #### Regulator & Framework Kenya's Office of the Data Protection Commissioner is understood to have moved, over the course of 2026, beyond an awareness-campaign and voluntary-compliance posture into a structured regime of regulator-led audits, compensation orders and court-enforced deletion mandates. This is a probable characterisation of the ODPC's shifting institutional posture rather than a confirmed, formally announced policy change, and it should be read as reflecting an operational shift in enforcement intensity rather than a change in the underlying Data Protection Act, 2019 itself. A Data Protection Amendment Bill is separately reported to propose expanded ODPC penalty powers and enhanced ODPC training and accreditation authority. Its status as of early-to-mid 2026 was described as pending legislative consideration, and whether it has since been tabled or passed, or remains at drafting stage, could not be confirmed this cycle. Any assessment of the ODPC's future powers should therefore treat this Bill as a proposed rather than settled development. #### Outlook The central open question for this module is whether the Data Protection Amendment Bill progresses beyond its currently uncertain legislative status. Continued observation of ODPC audit and enforcement activity, discussed further under Enforcement & Redress, will be the clearest available evidence of whether the reported shift toward a more operationalised compliance posture continues. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (17) - [International Association of Privacy Professionals](https://iapp.org/news/a/kenya-appoints-its-first-ever-data-protection-commissioner) — The Data Protection Commissioner oversees implementation and enforcement of the Act under Section 8, but the office remained unformed until Immaculate Kassait was sworn in as Kenya's first Data Commissioner on 16 November 2020. - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._kenya.pdf) — The Data Protection Act, 2019 came into force on 25 November 2019 and is the primary data protection legislation in Kenya. - [OneTrust DataGuidance](https://www.dataguidance.com/notes/kenya-data-protection-officer-appointment) — Sensitive personal data under the Act includes race, health status, ethnic/social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (names of children, parents, spouses), sex and sexual orientation. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/kenya-data-protection-considerations-ma-deals) — The Act applies to controllers/processors established or resident in Kenya, and separately to controllers/processors not established or resident in Kenya but who process personal data of data subjects located in Kenya, giving it broader extraterritorial reach than the GDPR's establishment-based test. - [International Association of Privacy Professionals](https://iapp.org/news/a/kenya-appoints-its-first-ever-data-protection-commissioner) — Section 18 provides no person shall act as a data controller or data processor unless registered with the Data Commissioner, who prescribes mandatory-registration thresholds considering industry nature, data volumes processed, and whether sensitive personal data is processed. - Primary statutory record — The Registration Regulations exempt controllers/processors with annual turnover below KES 5 million or fewer than 10 employees from registration, but registration remains mandatory regardless of size for specified high-risk processing activities; online/physical registration opened 14 July 2022. - [Anyega Osiemo & Co. Advocates](https://anyegaosiemo.com/blog/kenya-s-data-protection-enforcement-trends-in-2026-lessons-every-business-should-learn) — Section 63 of the Data Protection Act, 2019 empowers the Data Commissioner to impose an administrative fine of up to KES 5 million or 1% of the preceding year's annual turnover, whichever is lower. - [Lexology](https://www.lexology.com/library/detail.aspx?g=1a679769-2ca5-4c6e-9443-dedeee350fcf) — The Office of the Data Protection Commissioner (ODPC) is Kenya's data-protection regulator, established under the Data Protection Act, 2019. - [Covington & Burling](https://www.insideprivacy.com/cross-border-transfers/kenya-issues-new-cross-border-data-transfer-guidance-familiar-concepts-but-important-local-differences/) — The Data Protection Act, 2019 gives effect to Article 31 of the Constitution of Kenya on the right to privacy. - [Anyega Osiemo & Co. Advocates](https://anyegaosiemo.com/blog/kenya-s-data-protection-enforcement-trends-in-2026-lessons-every-business-should-learn) — Office of the Data Protection Commissioner (ODPC) — ODPC operates a public registration portal and register of data controllers and processors used, among other things, as a basis for risk-based audit selection. - [Lexology](https://www.lexology.com/library/detail.aspx?g=1a679769-2ca5-4c6e-9443-dedeee350fcf) — Office of the Data Protection Commissioner (ODPC) — In 2026 the ODPC moved beyond awareness campaigns and voluntary compliance into a structured regime of regulator-led audits, compensation orders and court-enforced deletion mandates. - [Manwa Advocates](https://manwaadvocates.com/the-data-protection-amendment-bill-2025/) — Data Protection (Amendment) Bill, 2025 — Proposes changing the administrative-fine cap from 'whichever is lower' (KES 5m or 1% of annual turnover) to 'whichever is higher', expanding complaints access from 'data subject' to 'any person', and creating a Data Protection Appeals Tribunal - [Kenyans.co.ke](https://www.kenyans.co.ke/news/123982-odpc-directs-entities-handling-peoples-data-register-or-face-ksh5-million-fine) — Office of the Data Protection Commissioner — ODPC has intensified enforcement of mandatory registration for data controllers/processors in 2026, with non-compliance risking fines of up to KES 5,000,000 - [https://research.lawlab.africa/kenya/](https://research.lawlab.africa/kenya/) — Data Protection Act, 2019 — In force; establishes Office of the Data Protection Commissioner as supervisory authority - [Global Law Experts](https://globallawexperts.com/kenyas-dataprotection-enforcement-turn-2026-audits/) — Data Protection (Amendment) Bill, 2025 — Proposes AI-governance, cross-border data-sharing and enhanced-penalty provisions; status not confirmed to a primary Gazette/National Assembly source - [Lexology](https://www.lexology.com/library/detail.aspx?g=1a679769-2ca5-4c6e-9443-dedeee350fcf) — The Office of the Data Protection Commissioner, headed by Data Commissioner Immaculate Kassait, is Kenya's operational data-protection enforcement authority. - [Covington & Burling](https://www.insideprivacy.com/cross-border-transfers/kenya-issues-new-cross-border-data-transfer-guidance-familiar-concepts-but-important-local-differences/) — The Data Protection Act, 2019 (No. 24 of 2019) is Kenya's primary data-protection statute, giving effect to Article 31(c) and (d) of the Constitution. ### Kenya: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core lawful-basis and special-category framework is legislated and in force, closely tracking GDPR structure. Primary framework Data Protection Act, 2019 (Kenya); Data Protection (General) Regulations, 2021 Supervisory authority [Office of the Data Protection Commissioner (ODPC)](https://www.odpc.go.ke/) Traffic-light rationale — Green Core lawful-basis and special-category framework is legislated and in force, closely tracking GDPR structure. D2 · Lawful Processing — Full Module Record 4 sub-modules · 79 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kenya: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Rights exist and are being enforced via ODPC orders, but the Act is comparatively thin on granular procedural mechanics/response deadlines for controllers. Primary framework Data Protection Act, 2019 (Kenya) Supervisory authority [Office of the Data Protection Commissioner (ODPC)](https://www.odpc.go.ke/) Traffic-light rationale — Amber Rights exist and are being enforced via ODPC orders, but the Act is comparatively thin on granular procedural mechanics/response deadlines for controllers. #### Sub-modules (5) #### Access RightAmber The Act provides an access right but with less detailed procedural guidance than GDPR on the exercise of data subject rights. Claims (1): - The Act provides less detailed information than the GDPR on the exercise of data subject rights. #### Rectification And ErasureAmber ODPC enforcement action confirms an operative erasure/rectification expectation: Platinum Credit was found to have failed to erase a complainant's data on request, and Nairobi Hospital was ordered to delete unlawfully obtained promotional recordings within 14 days. Claims (4): - The ODPC found Platinum Credit Limited violated the Act by using personal data for commercial purposes without consent, ignoring the complainant's objection to marketing messages, and failing to erase the complainant's data, ordering KES 900,000 in compensation. - The ODPC ordered The Nairobi Hospital to delete unlawfully-used promotional advertisements containing a patient's covertly recorded image and to provide proof of deletion within 14 days, alongside a KES 500,000 fine, for violations of Sections 32(1) and 37 of the Act. - ODPC determinations in 2025 enforced data-subject erasure and marketing-objection rights, including a case where a company ignored requests to delete personal data and stop unwanted marketing calls. - Office of the Data Protection Commissioner (ODPC) — In 2026 the ODPC operationalised court-enforced data-deletion mandates alongside compliance audits and compensation orders, moving beyond a prior awareness-and-registration-focused enforcement posture. #### Restriction And ObjectionAmber The right to object to processing (particularly direct marketing) is enforced in practice; Platinum Credit was sanctioned for ignoring a complainant's objection to marketing messages. Claims (1): - The ODPC found Platinum Credit Limited violated the Act by using personal data for commercial purposes without consent, ignoring the complainant's objection to marketing messages, and failing to erase the complainant's data, ordering KES 900,000 in compensation. #### Data PortabilityRed No specific enforcement action or detailed portability mechanic was identified in available sources beyond the Act's general rights framework. #### Deadlines And Response WindowsAmber No explicit statutory controller-response deadline for subject access/rectification/erasure requests (analogous to GDPR's one-month rule) was located; the only concrete procedural deadline identified is the ODPC's own 90-day complaint-resolution timeline under the Compliance and Enforcement Regulations, guided by the Fair Administrative Action Act 2015. Claims (1): - The Compliance and Enforcement Regulations require the ODPC to be guided by the Fair Administrative Action Act, 2015, which requires conclusion of complaints within 90 days. The Act provides data subject rights but with less procedural detail than the GDPR. Enforcement practice (e.g. the Platinum Credit and Nairobi Hospital decisions) shows the ODPC actively enforcing objection-to-marketing and erasure/consent rights. No explicit statutory SAR response-window analogous to GDPR's one-month rule was located in available sources; the clearest procedural deadline identified relates to ODPC's own complaint resolution (90 days) rather than a controller's response to a data-subject request. Periodic update · new data 2026-10-18 #### Data Subject Rights A 2026 court ruling is reported to have ordered the blanket deletion of biometric data collected from Kenyan citizens, described in commentary as a marker for how seriously Kenyan regulators and courts now treat data rights. The ruling reportedly follows a 2023 parliamentary inquiry into a company's processing of iris-scan data. Neither the precise case citation nor the statutory basis for the ruling has been retrieved; the finding is reported here as an uncertain development pending that confirmation, rather than as a settled precedent. If accurate, a court-ordered deletion remedy of this scope would represent a significant data-subject-rights enforcement mechanism going beyond the administrative fines more commonly associated with Kenya's data-protection regulator, since it would involve judicial rather than purely administrative enforcement of erasure rights. #### Outlook Locating the primary case citation and the statutory or constitutional basis for the ruling is the key outstanding step needed to confirm the scope and precedential weight of this development for data-subject erasure rights in Kenya. 2 earlier distinct update(s) Periodic update · new data 2026-09-21 #### Data Subject Rights Kenya's approach to enforcing data subject rights is understood to have strengthened operationally in 2026. The Office of the Data Protection Commissioner is reported to have operationalised court-enforced data-deletion mandates alongside compliance audits and compensation orders, a shift beyond what had previously been a more awareness- and registration-focused enforcement posture. This is a probable-confidence finding, sourced from secondary legal commentary rather than a primary ODPC rulemaking or policy document, but it describes a meaningful operational change: the erasure right is understood to now be backed by judicial enforcement mechanisms rather than resting solely on administrative complaint-handling. This development should be read as a strengthening of the practical exercise of rights already established under the Data Protection Act, 2019, rather than as the introduction of a new statutory right. The distinguishing feature this cycle is enforcement mechanism, not legal entitlement: the underlying erasure and rectification rights are pre-existing, but the pathway to their practical vindication is reported to have shifted toward court-enforced outcomes and compensation orders running alongside them. #### Outlook The key indicator to watch is whether specific court-enforced deletion cases become publicly documented through ODPC's Determinations records or through court judgments, which would allow this reported operational shift to be corroborated against primary-source case outcomes rather than resting on secondary commentary alone. Periodic update · new data 2026-09-14 #### Data Subject Rights ODPC determinations in 2025 are understood to have enforced data-subject erasure and marketing-objection rights concretely, in a matter reported as Bolo v. Platinum Credit, where a company reportedly ignored requests to delete personal data and stop unwanted marketing calls. This finding is reported at Probable confidence from a single secondary source, and represents the clearest evidence this cycle that Kenya's statutory data-subject rights under the Data Protection Act, 2019 are being given operational effect through individual enforcement determinations rather than remaining purely declaratory. The significance of this development lies less in the specific facts of the individual determination and more in what it signals about ODPC's willingness to act on rights-based complaints, which sits alongside the broader operational shift toward active enforcement documented elsewhere in this cycle's evidence. No further data-subject-rights determinations beyond this single reported matter were retrieved this cycle, and the precise remedial order issued in the case (compensation, deletion mandate, or both) was not fully specified in the available source. #### Outlook Further visibility into the volume and pattern of ODPC data-subject-rights determinations, beyond this single reported case, would help establish whether this is an isolated enforcement action or part of a broader pattern consistent with the operationalised-audit posture documented in the enforcement_and_redress module this cycle. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (6) - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v._kenya.pdf) — The Act provides less detailed information than the GDPR on the exercise of data subject rights. - [OneTrust DataGuidance](https://www.dataguidance.com/news/kenya-odpc-orders-platinum-credit-limited-pay-kes) — The ODPC found Platinum Credit Limited violated the Act by using personal data for commercial purposes without consent, ignoring the complainant's objection to marketing messages, and failing to erase the complainant's data, ordering KES 900,000 in compensation. - [OneTrust DataGuidance](https://www.dataguidance.com/news/kenya-odpc-orders-nairobi-hospital-pay-kes-500000) — The ODPC ordered The Nairobi Hospital to delete unlawfully-used promotional advertisements containing a patient's covertly recorded image and to provide proof of deletion within 14 days, alongside a KES 500,000 fine, for violations of Sections 32(1) and 37 of the Act. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/kenya-entry-force-2021-regulations) — The Compliance and Enforcement Regulations require the ODPC to be guided by the Fair Administrative Action Act, 2015, which requires conclusion of complaints within 90 days. - [Office of the Data Protection Commissioner](https://www.odpc.go.ke/wp-content/uploads/2026/09/ODPC-%E2%80%93-Guidance-Notes-for-Cross-border-Data-Transfers.pdf) — ODPC determinations in 2025 enforced data-subject erasure and marketing-objection rights, including a case where a company ignored requests to delete personal data and stop unwanted marketing calls. - [Recording Law](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/kenya-data-privacy-laws/) — Office of the Data Protection Commissioner (ODPC) — In 2026 the ODPC operationalised court-enforced data-deletion mandates alongside compliance audits and compensation orders, moving beyond a prior awareness-and-registration-focused enforcement posture. ### Kenya: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core accountability, DPIA, and breach-notification duties are legislated and enforced, but DPO mandate is non-binding in practice and ROPA/joint-controller mechanics are comparatively underdeveloped versus GDPR. Primary framework Data Protection Act, 2019 (Kenya); Data Protection (General) Regulations, 2021 Supervisory authority [Office of the Data Protection Commissioner (ODPC)](https://www.odpc.go.ke/) Traffic-light rationale — Amber Core accountability, DPIA, and breach-notification duties are legislated and enforced, but DPO mandate is non-binding in practice and ROPA/joint-controller mechanics are comparatively underdeveloped versus GDPR. Periodic update · new data 2026-10-11 #### Controller/Processor Duties The High Court ordered Worldcoin to delete biometric data it had collected from Kenyans, finding that the collection occurred without a valid data protection impact assessment and without proper consent from the individuals concerned. The Office of the Data Protection Commissioner confirmed in January 2026 that the ordered deletion had been completed, bringing to a close what has been the most prominent controller-accountability matter litigated under the Data Protection Act 2019 to date. The case turned on the absence of a valid DPIA prior to a large-scale biometric data collection exercise, underscoring that the DPIA obligation is treated by both the court and the regulator as a precondition to lawful collection of sensitive biometric data rather than a procedural formality that can be satisfied after the fact. The precise statutory pinpoint for Kenya's breach-notification deadline, commonly cited elsewhere as a 72-hour standard, was not confirmed directly against the Act or Regulations text this cycle, and that gap is noted rather than resolved by assumption. #### Outlook With the Worldcoin deletion now complete, attention in this module shifts to whether the DPIA standard applied in that case is replicated in future ODPC guidance or enforcement action against other large-scale biometric or identity-verification projects operating in Kenya. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Under the Data Protection Act, 2019, breaches must be notified within 72 hours to the ODPC, with a shorter 24-hour notification window applying to designated critical-infrastructure operators. This tiered notification structure reflects a risk-differentiated approach to breach-notification timing that predates this cycle's enforcement developments but remains the operative standard against which 2026 enforcement activity should be read. Reports suggest a Kenyan court ordered the deletion of biometric data that had been collected without a sufficient lawful basis, an intervention described as one of the most significant judicial data-protection enforcement moments of this cycle. Because this claim rests on Uncertain-confidence secondary reporting rather than a primary judicial record, it should be read as an attributed development rather than a confirmed judicial finding — a court is reported to have taken this action, but the underlying judgment itself has not been independently verified this cycle. Taken together, the breach-notification framework and the reported biometric-deletion order point toward a controller/processor compliance environment in which retention and disposal practices, and the underlying lawful-basis question for sensitive data such as biometrics, are receiving active regulatory and judicial attention in 2026. #### Outlook Confirmation of the underlying judicial record behind the reported biometric-data deletion order, and any pattern of similar interventions concerning lawful basis for sensitive-data collection, are the developments to track for this module going forward. Periodic update · new data 2026-09-21 #### Controller/Processor Duties Kenya's compliance-audit regime for controllers and processors is reported to be fully operational in 2026, with a documented set of audit triggers: individual complaints, risk-based sectoral targeting concentrated on financial services and health-technology, random selection from ODPC's register of data controllers and processors, enforcement-notice follow-up, and referral from bodies such as the Office of the Auditor General. This is a probable-confidence finding drawn from secondary legal commentary, and it represents a materially more systematic audit-trigger taxonomy than a purely complaint-reactive model would imply. ODPC is understood to operate a public registration portal functioning also as a register of data controllers and processors, which supports the random-selection audit-trigger mechanism described above. This registration and register function has probable-confidence, sourced from industry-body commentary, and it sits alongside the individual-complaint and referral-based audit triggers as one of several distinct routes into ODPC compliance-audit scrutiny. What remains genuinely unconfirmed this cycle is whether the previously-proposed Data Protection Compliance Audit Regulations, 2024 have since been finalised and gazetted. If they have not, the audit-trigger taxonomy described above would rest on ODPC administrative practice rather than on a codified regulatory instrument, a distinction that matters for controllers seeking to understand the legal basis of an audit they might face. #### Outlook Watch for confirmation of whether the Data Protection Compliance Audit Regulations, 2024 have been finalised and gazetted, since that would clarify whether the current audit-trigger taxonomy operates on a formal regulatory basis or as ODPC administrative practice pending such codification. D4 · Controller & Processor — Full Module Record 7 sub-modules · 69 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kenya: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Transfer mechanisms exist in principle but lack a developed adequacy/SCC infrastructure, and sectoral/strategic-interest data localisation mandates add complexity and legal uncertainty (as illustrated by ongoing Worldcoin litigation). Primary framework Data Protection Act, 2019 (Kenya), Part VII; Data Protection (General) Regulations, 2021 Supervisory authority [Office of the Data Protection Commissioner (ODPC)](https://www.odpc.go.ke/) Traffic-light rationale — Amber Transfer mechanisms exist in principle but lack a developed adequacy/SCC infrastructure, and sectoral/strategic-interest data localisation mandates add complexity and legal uncertainty (as illustrated by ongoing Worldcoin litigation). Periodic update · new data 2026-11-04 #### Cross-Border & Adequacy The Office of the Data Protection Commissioner has published Guidance Notes for Cross-border Data Transfers that confirm, for the first time with this degree of specificity, that processing personal data in a cloud environment with servers located outside Kenya constitutes a cross-border transfer requiring a lawful transfer basis. This extends expressly to routine backups and to access by a group's head office or regional affiliates, closing what had been a grey area for multinational controllers relying on shared cloud infrastructure. Where sensitive personal data cannot satisfy the applicable transfer test, the guidance, read together with section 49 of the Data Protection Act, 2019, requires that the data be processed through a Kenyan-located data centre, or that at least one serving copy be retained in Kenya. Kenyan law does not prohibit cross-border transfers as a category; the guidance instead sets out the conditions under which such transfers are lawful, with this localisation requirement acting as a fallback for the highest-sensitivity category of data. Separately, the dialogue between Kenya and the European Union toward a possible adequacy decision is continuing but unconcluded. The European Commission indicated in June 2026 that it welcomed progress in that process and noted a positive assessment so far, without committing to a timetable for a final decision. #### Outlook Controllers relying on offshore or regional cloud infrastructure for Kenyan personal data now have a clearer, but more demanding, rulebook to work against, particularly where sensitive categories of data are involved. The unresolved adequacy dialogue with the European Union is a separate track that, if concluded favourably, would ease EU-to-Kenya flows specifically without displacing the broader localisation fallback that now applies to sensitive data more generally. Periodic update · new data 2026-10-11 #### Cross-Border & Adequacy The Office of the Data Protection Commissioner published final Guidance Notes for Cross-border Data Transfers on 8 September 2026, following a public consultation draft circulated in April 2026. The final Guidance Notes include standard clauses for use in both controller-to-controller and controller-to-processor cross-border transfer arrangements, giving organisations transferring personal data out of Kenya a reference mechanism the regulator has endorsed, where previously the statutory transfer conditions existed without implementing guidance of this kind. Whether the Guidance Notes constitute binding guidance or a non-binding code of practice was not independently characterised this cycle, and that distinction matters for how strictly an organisation's reliance on the standard clauses would be assessed in an enforcement context; the gap is recorded here rather than resolved by inference. #### Outlook The near-term question is how organisations and the regulator treat reliance on the new standard clauses in practice, and whether the ODPC clarifies the binding status of the Guidance Notes in subsequent communications or enforcement decisions. Periodic update · new data 2026-09-28 #### Cross-Border & Adequacy The ODPC issued Guidance Notes for Cross-Border Data Transfers in 2026, setting duties for controllers and processors around lawful cross-border transfer conditions and mandatory registration. This is a primary-source regulatory development, published directly by the ODPC, and represents the clearest first-party evidence of movement in this module this cycle. Separately, and resting on lower-tier secondary commentary, Kenya's Data Protection Act is reported to closely mirror the GDPR, a structural similarity said to position Kenya for a potential positive EU adequacy determination. As of early 2026 reporting, the Kenya-EU adequacy dialogue — understood to have launched in May 2024 — remained ongoing without a concluded decision, and this cycle's research could not confirm the dialogue's current substantive status as of September 2026. This should be read as an open, unresolved question rather than a settled position in either direction. Also resting on secondary commentary, the ODPC's Cloud Policy is reported to encourage data localisation when entities adopt cloud solutions, with particular emphasis on sensitive government and critical-infrastructure data. This localisation encouragement is described in attributed terms only, reflecting the Uncertain confidence attached to the underlying source. #### Outlook The unresolved status of the Kenya-EU adequacy dialogue is the central gap to close in future cycles. Confirmation of the dialogue's current substantive status, and any further detail on how the new Cross-Border Guidance Notes interact with the reported cloud-localisation encouragement, would materially sharpen this module's picture. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 52 words · 16 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kenya: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Multiple sectoral overlays exist and interact with the DPA (telecoms, payments, health), but coverage is uneven and some sectors (education, insurance) show no distinct DP overlay in available sources. Primary framework Data Protection Act, 2019 (Kenya); Kenya Information and Communications Act, 1998; National Payment System Act Supervisory authority [Office of the Data Protection Commissioner (ODPC)](https://www.odpc.go.ke/) Traffic-light rationale — Amber Multiple sectoral overlays exist and interact with the DPA (telecoms, payments, health), but coverage is uneven and some sectors (education, insurance) show no distinct DP overlay in available sources. Periodic update · new data 2026-10-18 #### Sectoral Watch The Virtual Asset Service Providers Regulations, 2026 establish a Virtual Assets Services Coordination Forum bringing together the Office of the Data Protection Commissioner, the Financial Reporting Centre, and other regulatory bodies, with a stated purpose of supporting information sharing, coordinated supervision and cross-sector regulatory cooperation. This is a confirmed structural development: it creates a formal mechanism linking Kenya's data-protection regulator into oversight of the virtual-asset sector, which is otherwise supervised primarily by the Central Bank of Kenya and the Capital Markets Authority under the same Regulations. The Forum's establishment signals that Kenya's regulators are treating virtual-asset activity as cross-sectoral in nature, implicating data-protection obligations (given the personal-data processing inherent in customer due diligence and transaction monitoring for virtual-asset services) alongside the more familiar anti-money-laundering and prudential concerns. This is the first identified instance this cycle of a sector-specific coordination body formally including the ODPC as a named participant. #### Outlook How the Virtual Assets Services Coordination Forum operates in practice, including whether it issues joint guidance or coordinates enforcement actions, will be the next indicator of whether this structural development translates into practical cross-sector regulatory coordination. Periodic update · new data 2026-09-21 #### Sectoral Watch Financial services and health-technology have been flagged this cycle as the Kenyan sectors facing the highest probability of Office of the Data Protection Commissioner enforcement attention in 2026, alongside a broader category of data-rich sectors including telecommunications, digital platforms and HR outsourcing. This sectoral-risk framing is a probable-confidence finding, sourced from secondary legal commentary rather than a primary ODPC risk-assessment publication, but it aligns with and is reinforced by the reported shift toward risk-based sectoral targeting as one of several ODPC compliance-audit triggers. The financial-services sectoral flag in particular sits alongside a broader pattern of increased regulatory attention on Kenya's financial sector this cycle across multiple regulatory domains, though this brief does not extend into financial-integrity or payments-specific analysis of that overlap; it notes only that data-protection audit exposure for financial-services controllers and processors should be assessed as a distinct, additional compliance vector alongside sector-specific financial regulation. #### Outlook The indicator to watch is whether the sectoral-targeting signal translates into visible published enforcement outcomes specifically against financial-services or health-tech controllers in ODPC's Determinations records over the coming cycles, which would corroborate this cycle's secondary-sourced sectoral-risk framing with primary enforcement evidence. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 88 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kenya: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct-marketing consent/opt-out rules are legislated and actively enforced, but Kenya has no distinct cookie/tracker, dark-pattern, or cross-context-advertising regime comparable to EU ePrivacy or US state adtech laws. Primary framework Data Protection (General) Regulations, 2021 Supervisory authority [Office of the Data Protection Commissioner (ODPC)](https://www.odpc.go.ke/) Traffic-light rationale — Amber Direct-marketing consent/opt-out rules are legislated and actively enforced, but Kenya has no distinct cookie/tracker, dark-pattern, or cross-context-advertising regime comparable to EU ePrivacy or US state adtech laws. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 82 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kenya: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Biometric/ADM processing is captured via DPIA triggers and is the subject of active, high-profile enforcement (Worldcoin), but no dedicated AI risk-assessment framework exists and national-security exemptions are broadly drawn. Primary framework Data Protection Act, 2019 (Kenya); Data Protection (General) Regulations, 2021 Supervisory authority [Office of the Data Protection Commissioner (ODPC)](https://www.odpc.go.ke/) Traffic-light rationale — Amber Biometric/ADM processing is captured via DPIA triggers and is the subject of active, high-profile enforcement (Worldcoin), but no dedicated AI risk-assessment framework exists and national-security exemptions are broadly drawn. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance A 2026 court ruling is reported to have ordered the blanket deletion of biometric data collected from Kenyan citizens, a development commentary describes as a marker of how seriously Kenyan regulators and courts now treat data rights. This followed a 2023 parliamentary inquiry into a company's processing of iris-scan data. The case citation has not been retrieved this cycle, so the ruling is reported here as an uncertain development. Separately, the pending Data Protection (Amendment) Bill, 2025 is reported to propose new obligations around artificial intelligence, though its legislative status, whether it remains proposed or has advanced toward enactment, has not been confirmed against a primary Gazette or National Assembly source this cycle. Together these two threads, a judicial biometric-deletion order and a pending AI-governance legislative proposal, indicate algorithmic and biometric governance is an area of active development in Kenya's data-protection landscape, even though neither thread is yet confirmed to primary-source standard. #### Outlook Confirmation of the biometric-ruling case citation and of the Amendment Bill's legislative status are both needed before either development can be treated as settled. Progress on either front would materially sharpen the picture of how Kenya is approaching AI and biometric governance. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance Kenya's Artificial Intelligence Bill, 2026 would tie AI governance directly to the Data Protection Act 2019, requiring high-risk AI providers and deployers to comply with data protection impact assessment obligations under that Act. Beyond the high-risk category, the Bill would require all providers and deployers of AI systems, regardless of risk tier, to disclose to users the nature, purpose and limitations of the system in use, the extent to which decisions affecting the user are made through automated decision-making, and the bias-mitigation measures the provider or deployer has in place. The Bill was published as a Senate Bill but has not yet been tabled for debate as of early 2026, and some commentary has characterised the proposal as premature given the state of Kenya's broader AI governance infrastructure. The Worldcoin biometric-data matter, discussed separately under controller/processor duties, is relevant background here: it demonstrates that the DPIA obligation the Bill would extend to high-risk AI is already being enforced by the High Court and the ODPC in the biometric-data context, even in advance of any AI-specific statute. #### Outlook The Bill's progress toward being tabled for parliamentary debate is the development to watch; until that occurs, the DPIA and disclosure obligations it proposes remain proposed rather than binding, and the only DPIA enforcement precedent in this space remains the Worldcoin case decided under the existing Data Protection Act 2019. Periodic update · new data 2026-09-28 #### Algorithmic, Biometric & Surveillance Governance A Kenyan court is reported to have ordered deletion of biometric data collected without a sufficient lawful basis, marking what secondary commentary describes as a significant judicial data-protection enforcement moment in 2026. As this claim rests on Uncertain-confidence sourcing, it is presented here as an attributed development — reports suggest this occurred — rather than as a confirmed judicial finding, pending independent verification of the underlying case record. Separately, a draft Artificial Intelligence Bill 2026, understood to be a Senate Bill, is reported to propose a risk-based regime for AI systems modelled in part on the EU AI Act, with stringent obligations envisaged for systems classified as high-risk. This Bill remains at proposed stage; it has not been confirmed enacted, and its EU-AI-Act-style risk-based structure should be read as a reported design feature of the draft rather than as an operative legal standard in Kenya at this time. Read together, the reported biometric-deletion order and the draft AI Bill point toward an emerging, but not yet consolidated, algorithmic and biometric governance dimension within Kenya's data-protection landscape — one presently anchored more in judicial intervention on a specific lawful-basis question than in a dedicated statutory framework, pending the AI Bill's possible enactment. #### Outlook Whether the draft Artificial Intelligence Bill 2026 advances beyond proposed stage, and whether further confirmation emerges of the underlying judicial record behind the reported biometric-data deletion order, are the two developments to track for this module. Periodic update · new data 2026-09-14 #### Algorithmic, Biometric & Surveillance Governance Reports suggest a draft Artificial Intelligence Bill 2026, understood to be a Senate Bill, proposes a risk-based AI governance regime for Kenya that would establish an Office of the Artificial Intelligence Commissioner and would require providers and deployers of high-risk AI systems to conduct data protection impact assessments under the existing Data Protection Act, 2019 before deploying such systems. This is an Uncertain-confidence finding, sourced from a single secondary reference, and the Bill had not been enacted as of this cycle's evidence. The significance of this development, if it proceeds, is structural: it would be the first instance of Kenya's AI governance framework being explicitly wired into its existing data-protection impact-assessment machinery rather than creating a wholly separate compliance track, meaning high-risk AI deployment would trigger obligations under a statute AI developers may already be familiar with from other processing contexts. However, given the single-source basis for this finding and its Uncertain confidence tier, this should be read as an early-stage legislative proposal rather than an imminent compliance obligation. #### Outlook The Bill's progress through the Senate, and whether its DPIA-linkage provision survives into any enacted form, are the key developments to track. Given the current evidence base rests on a single secondary source, corroboration from an additional independent source or from the Bill's own text would materially strengthen confidence in this finding for the next cycle. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 89 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kenya: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A children's-data provision exists in statute (Section 33) but lacks the granularity of GDPR Art 8 (no explicit age-of-consent threshold in the Act itself, no age-verification mechanics, no dependent-adult provisions located). Primary framework Data Protection Act, 2019 (Kenya), Section 33 Supervisory authority [Office of the Data Protection Commissioner (ODPC)](https://www.odpc.go.ke/) Traffic-light rationale — Amber A children's-data provision exists in statute (Section 33) but lacks the granularity of GDPR Art 8 (no explicit age-of-consent threshold in the Act itself, no age-verification mechanics, no dependent-adult provisions located). D9 · Children's Privacy — Full Module Record 5 sub-modules · 58 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Kenya: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Enforcement powers are legislated and actively used (multiple 2025-2026 fines/orders), but resourcing/independence concerns persist and collective-redress/private-right-of-action mechanisms remain undeveloped. Primary framework Data Protection Act, 2019 (Kenya); Data Protection (Compliance and Enforcement) Regulations, 2021 Supervisory authority [Office of the Data Protection Commissioner (ODPC)](https://www.odpc.go.ke/) Traffic-light rationale — Amber Enforcement powers are legislated and actively used (multiple 2025-2026 fines/orders), but resourcing/independence concerns persist and collective-redress/private-right-of-action mechanisms remain undeveloped. Periodic update · new data 2026-11-04 #### Enforcement & Redress The Office of the Data Protection Commissioner's cumulative enforcement record stands at 20 penalty notices, 357 determinations, 134 enforcement notices, and 184 compensation orders, issued against a total of 9,061 complaints received since the Data Protection Act, 2019 came into force. Section 63 of that Act empowers the Commissioner to impose an administrative fine of up to KES 5 million or 1% of the controller's annual turnover for the preceding financial year, whichever is lower, giving the enforcement figures a defined financial ceiling even as the volume of regulatory activity continues to build. A Data Protection (Amendment) Bill reportedly remains pending before Parliament. It is understood to propose provisions on AI governance, more specific controls on cross-border data sharing, and the creation of a dedicated Data Protection Appeals Tribunal, although its current parliamentary reading stage has not been confirmed against official National Assembly records, and this should be treated as an unconfirmed development rather than a settled legislative fact. #### Outlook The steady accumulation of determinations and compensation orders points to an enforcement body that is operationally active rather than merely statutory on paper. Whether the proposed Amendment Bill advances, and in particular whether its cross-border data-sharing and AI-governance provisions are retained as reported, is worth tracking given its potential to reshape both the enforcement toolkit and the cross-border transfer regime described elsewhere in this briefing. Periodic update · new data 2026-10-18 #### Enforcement & Redress A secondary tracker dossier reports 303 tracked Kenyan data-protection decisions as of 29 July 2026, comprising 301 ODPC decisions and 2 High Court decisions, with a cumulative KES69.2 million in compensation ordered across those decisions. The largest single award recorded in this tracker is KES10,000,000, made against Oxygene Marketing Communication Limited in April 2026. This volume and scale of enforcement activity is reported as indicating a maturing supervisory capacity for the ODPC, distinct from the enforcement posture of many other sub-Saharan African data-protection regulators. This finding rests on a secondary tracker dossier rather than a primary ODPC decision register, so the precise figures, 303 decisions and KES69.2 million in total compensation, should be read as a reported aggregate pending independent confirmation. The enforcement pattern is corroborated in direction, if not in exact figures, by the separately reported Mulla Pride/KeCredit-Faircash direct-marketing fine described under AdTech & Commercial Privacy. #### Outlook Independent verification of the 303-decision, KES69.2 million aggregate against a primary ODPC source would confirm the scale of enforcement activity reported this cycle. Separately, a draft Data Protection (Conduct of Compliance Audit) Regulations, if finalised, would give the ODPC a formal procedural framework for on-site and desk-based compliance inspections, a potential further expansion of its enforcement toolkit beyond the fines and compensation orders reported here. Periodic update · new data 2026-10-11 #### Enforcement & Redress Enforcement activity by the Office of the Data Protection Commissioner intensified markedly through 2026. The ODPC determined 96 complaints in 2025, almost double the number determined the prior year, and has issued 134 enforcement notices and 20 penalty notices in total since the Data Protection Act's inception. In a single batch in January 2026, the ODPC issued 184 compensation orders, a volume that on its own exceeds the entire prior year's complaint determinations. Administrative fines currently available to the ODPC are capped at KES 5,000,000 or 1% of an organisation's annual turnover, whichever is lower, under section 63 of the Act. This escalation in enforcement volume is occurring in parallel with, but is legally distinct from, the proposed Data Protection (Amendment) Bill, 2025, which would reverse the fine-cap formula to "whichever is higher" and expand standing to complain from "data subject" to "any person." The current enforcement figures reflect activity under the existing "whichever is lower" cap; the Bill has not been enacted and its penalties have not yet taken effect. #### Outlook The trajectory is escalating on current law alone, independent of whether the Amendment Bill is enacted. Should the Bill proceed, the combination of already-elevated enforcement volume and a higher potential fine ceiling would represent a substantially more exposed compliance environment than existed prior to 2026. Periodic update · new data 2026-09-28 #### Enforcement & Redress The ODPC determined 96 complaints in 2025, with penalties available of up to KES 5 million or 1% of annual turnover under section 63 of the Data Protection Act, 2019. This complaint-determination volume is the clearest available quantitative indicator of the ODPC's enforcement activity level heading into this cycle's reported shift toward more operationalised compliance activity. In Regus Kenya Limited v Data Protection Commissioner [2025] eKLR, the High Court is understood to have upheld the ODPC's findings concerning unsolicited marketing continued after relationship termination, while reducing the penalty applied given the respondent's status as a first-time offender. This judicial outcome is significant on two fronts: it confirms judicial deference to the ODPC's substantive determination on unsolicited-marketing conduct, while also demonstrating that courts will moderate penalty severity for first-time offenders even where the underlying finding is upheld. A Data Protection Amendment Bill is reported to propose expanding the ODPC's penalty toolkit, introducing graduated administrative penalties calibrated to the severity and duration of an infringement, above the current KES 5 million / 1% turnover cap. This proposal remains at an uncertain legislative stage; whether it has been tabled, is still in drafting, or has otherwise progressed could not be confirmed this cycle, and it should be read as a reported proposal rather than a settled change to the penalty regime. #### Outlook Whether the Data Protection Amendment Bill's proposed graduated-penalty structure advances, and whether the ODPC's 2026 complaint-determination volume continues at or above the 2025 pace of 96 determinations, are the concrete markers to track for this module going forward. Periodic update · new data 2026-09-21 #### Enforcement & Redress Kenya's data-protection enforcement regime is reported to have undergone a material posture shift in 2026, moving from roughly five years of a largely reactive, registration- and education-focused approach into a structured phase featuring regulator-led compliance audits, compensation orders, and court-enforced data-deletion mandates. This is a probable-confidence characterisation resting on secondary legal commentary, but it is a coherent and internally consistent account across the specific enforcement mechanisms it describes. Procedurally, the enforcement framework continues to rest on the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021, under which Regulation 14 requires the Data Commissioner, on conclusion of an investigation, to make a determination based on the findings of that investigation. This is a confirmed, primary-source-evidenced procedural requirement, directly sourced from ODPC's own published materials. Consistent with that procedural framework, ODPC maintains and publishes annual Determinations records spanning 2023, 2024, 2025 and 2026, a primary-source-confirmed pattern evidencing ongoing and continuous case-decision output over multiple years rather than a single enforcement episode. The compliance-audit trigger taxonomy described this cycle — individual complaints, risk-based sectoral targeting on financial services and health-technology, random register-based selection, enforcement-notice follow-up, and inter-agency referral — sits within this broader enforcement architecture as the mechanism by which new audit activity is reported to be generated, feeding into the determination process that Regulation 14 requires. #### Outlook Watch for whether the volume or substance of ODPC's published annual Determinations shows a measurable increase or shift in character (for example, toward more financial-services or health-tech subject matter, or toward more compensation-order or deletion-mandate outcomes) in the 2026 records as they are finalised and published, which would provide primary-source corroboration of this cycle's reported enforcement-posture shift. Periodic update · new data 2026-09-14 #### Enforcement & Redress The ODPC is reported to have shifted its operational posture during 2026 from a largely reactive, registration-and-awareness-focused stance into structured compliance audits, compensation orders, and court-enforced data-deletion mandates, with a third-party tracker recording 303 decisions as of July 2026. This is a Probable-confidence finding and represents the single clearest enforcement-trajectory signal in this cycle's Kenya evidence: a regulator moving into an active phase after several years of a more dormant statutory presence. This operational shift sits within a standing statutory penalty framework: the Data Commissioner may impose administrative fines of up to KES 5,000,000, or 1% of an organisation's annual turnover for the preceding financial year, whichever is lower, under section 63 of the Data Protection Act, 2019. This penalty ceiling has not changed this cycle, but its practical relevance has increased materially given the reported shift toward active audit and enforcement activity — a statutory ceiling only matters once a regulator is actually applying it, and the evidence this cycle suggests ODPC is doing so with increasing frequency. #### Outlook The key question for future cycles is whether the reported 303-decision volume translates into a sustained pattern of formal administrative fines under the section 63 ceiling, as opposed to compensation orders and deletion mandates that may not always involve a monetary penalty. Sector-level audit-selection patterns, particularly in financial services, telecoms, health-tech, digital platforms and HR outsourcing, are also worth tracking as indicators of where enforcement pressure will concentrate next. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 26 words · 18 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties