Module 1: Foundations of Data Protection in Kenya

Why the Data Protection Act Matters to Your Business

Almost every business in Kenya handles personal data. A shop keeps customer phone numbers for delivery. A clinic keeps patient records. An SME keeps employee ID numbers, bank details and next of kin. A lender keeps M-Pesa statements and credit information. The Data Protection Act, 2019 sets the rules for how all of this information may be collected, used, stored, shared and deleted. Understanding it is no longer optional for a well-run business.

Where the Act comes from

Article 31 of the Constitution of Kenya protects every person's right to privacy, including the right not to have information relating to their family or private affairs unnecessarily required or revealed, and the right not to have the privacy of their communications infringed. The Data Protection Act gives effect to that right. It came into force in November 2019 and created the Office of the Data Protection Commissioner (ODPC) to oversee compliance. In 2021, several sets of regulations were made under the Act, covering general obligations, registration of data controllers and processors, and complaints handling and enforcement. Together, the Act and regulations are the framework you need to follow.

Who the Act applies to

The Act applies to the processing of personal data by a data controller or data processor established or resident in Kenya, and also to those outside Kenya who process personal data of people located in Kenya. In practice, if your business collects or uses information about identifiable people in Kenya, the Act almost certainly applies to you, regardless of your size. Small businesses may be exempt from registration in some cases, as you will see later, but they are not exempt from the duty to handle data lawfully.

Why it matters commercially, not just legally

• Enforcement is real. The ODPC can investigate complaints, issue enforcement notices, and impose administrative fines. The Act sets the maximum administrative fine at up to KES 5 million or 1 percent of the previous year's annual turnover, whichever is lower. The ODPC has published decisions against Kenyan businesses, and individuals can also be awarded compensation.
• Customers notice. People increasingly ask why you want their ID number or how you got their phone number. Clear, honest handling builds trust.
• Partners require it. Banks, payment providers, multinationals and government agencies often require suppliers to show data protection compliance in contracts and due diligence.
• Good data handling reduces risk. Collecting less data and securing it well lowers the damage when something goes wrong.

Worked example: a small business and its everyday data

Consider Upendo Pharmacy, a hypothetical chemist in Kitengela with six staff. In a typical week it:

• records customer names and phone numbers for prescription refill reminders;
• keeps copies of prescriptions, which reveal health information;
• runs CCTV in the shop;
• keeps staff files with ID copies, KRA PINs, bank details and next of kin;
• sends promotional SMS messages to customers.

Each of these is processing of personal data. Health information is sensitive personal data with extra protections. Promotional SMS raises direct marketing rules. CCTV captures images of identifiable people. The owner may think of the pharmacy as a small shop, but under the Act it is a data controller with real obligations. The rest of this course shows how to meet them in a practical, proportionate way.

Common mistakes to avoid

• Assuming the Act is only for big companies or tech firms. It applies to any business processing personal data.
• Treating compliance as a one-off document. A privacy policy on a website is not compliance if the business does not follow it.
• Collecting data "just in case". Every extra field you collect is something you must justify, secure and eventually delete.
• Relying on outdated guidance. The ODPC issues guidance notes and decisions that clarify how the Act applies. Check its official website regularly.

This lesson gives awareness-level guidance on the Data Protection Act, 2019 and its regulations. It is not legal advice. For specific situations, read the current law and guidance published by the Office of the Data Protection Commissioner (ODPC), or consult a qualified advocate.