Meet Kenya's data protection obligations with confidence.
The Data Protection Act, 2019 sets out how organizations operating in Kenya must collect, process, store and protect personal data. Seraph helps organizations assess current data handling practices, close compliance gaps, and maintain ongoing alignment with the Act.
Understanding the Kenya Data Protection Act.
What It Is
The Data Protection Act, 2019 establishes Kenya's legal framework for the collection, processing and protection of personal data, enforced by the Office of the Data Protection Commissioner (ODPC). It closely mirrors GDPR's principles, but adds Kenya-specific registration and, in some cases, data-localization requirements.
Consequences of Non-Compliance
The ODPC can issue fines, and unregistered data controllers or processors face both financial penalty and operational risk — including enforcement notices that can halt processing activity.
- Enacted
- 2019 (Kenya)
- Regulator
- Office of the Data Protection Commissioner
- Type
- Binding national law
- Registration
- Mandatory ODPC registration for most controllers/processors
- Applies to
- Any org processing Kenyan residents' personal data
Registration, 7 principles, and data subject rights.
ODPC Registration
Controllers and processors above threshold must register annually.
Core Principles
Lawfulness, purpose limitation, minimisation, accuracy, storage limits, security, accountability.
Data Subject Rights
Access, correction, deletion, objection to processing.
Cross-Border Transfers
Restrictions on transferring data outside Kenya without adequate safeguards.
From understanding obligations to ongoing compliance.
A structured path from understanding the Act to maintaining compliance as your organization evolves.
Understand Your Obligations
Clarify what the Data Protection Act requires and how it applies to your organization's data processing activities.
Assess Current Data Handling
Map what personal data you collect, process and store, and how it moves through your organization.
Identify Compliance Gaps
Compare current practice against the Act's requirements and document specific gaps, rated by risk.
Develop Policies & Controls
Build the data protection policies, consent mechanisms and controls the Act requires.
Implement & Register
Roll out improvements and meet applicable registration and documentation obligations with the Office of the Data Protection Commissioner.
Maintain Ongoing Compliance
Sustain compliance as data processing activities, systems and third-party relationships evolve.
Technology supporting this solution.
Frequently Asked Questions
Can't find what you need? Ask a security expert.
Ready to address your Data Protection Act obligations?
Tell us about your current data handling practices. Our team will help scope a compliance engagement.