Kenya

KE schema gdpri-v2 trajectory: not yet assessedin transitionoverlaps: FIM, WPM, AIC, Crypto

Last updated 2026-09-28 · 10 categories · 46 claims · 26 sources in the cumulative register

10Categoriesbaseline.[]

57Sub-modulesbaseline..sub_modules{}

46Claimsbaseline..claims[]

1Tier-1 sourcesrun_metadata.t1_source_count

Traffic-light mix (sums to 10 rendered categories; click to filter)

No red categories; 20 sub-modules are flagged red.

Jurisdiction brief

Latest update · 28 September 2026

Lead Signal

Kenya's Office of the Data Protection Commissioner moved in 2026 from an awareness-and-voluntary-compliance posture into a structured regime of regulator-led audits, compensation orders and court-enforced deletion mandates. This transition is understood to mark the most significant institutional development for Kenya's data-protection regime this cycle: the ODPC's enforcement posture has shifted from registration and education toward active operationalised compliance activity.

Other Developments

A court ordered deletion of unlawfully collected biometric data. Reports suggest a Kenyan court ordered the deletion of biometric data that had been collected without a sufficient lawful basis, described as one of the most significant judicial data-protection enforcement interventions of the cycle. This sits alongside a draft Artificial Intelligence Bill 2026, a Senate Bill reported to propose a risk-based regime for AI systems modelled in part on the EU AI Act, with stringent obligations for high-risk systems; this AI Bill remains at proposed stage and has not been confirmed enacted.

New cross-border transfer guidance has been issued. The ODPC published Guidance Notes for Cross-Border Data Transfers in 2026, setting duties for controllers and processors on lawful transfer conditions and mandatory registration. Separately, Kenya's Data Protection Act closely mirrors the GDPR, a structural feature reported to position the country for a potential positive EU adequacy determination; as of early 2026 reporting, the Kenya-EU adequacy dialogue remained ongoing without a concluded decision, and the current status of that dialogue as of this cycle could not be confirmed.

Enforcement activity and proposed penalty expansion. The ODPC determined 96 complaints in 2025, with penalties available of up to KES 5 million or 1% of annual turnover under section 63 of the Data Protection Act. The High Court is understood to have upheld the ODPC's findings in Regus Kenya Limited v Data Protection Commissioner [2025] eKLR on unsolicited marketing after relationship termination, while reducing the penalty applied to the first-time offender. A Data Protection Amendment Bill is reported to propose expanding the ODPC's penalty toolkit with graduated administrative penalties calibrated to the severity and duration of an infringement, sitting above the current KES 5 million / 1% turnover cap; whether this Bill has been tabled or passed, or remains at drafting stage, could not be confirmed this cycle.

Cross-Monitor Connections

The draft National Payment System Bill 2026's open-finance data-sharing provisions, tracked by the world-payments monitor, carry data-protection-adjacent implications for controller and processor obligations under Kenya's Data Protection Act, though this brief does not independently assess the payments-market dimension of that reform. The draft Artificial Intelligence Bill 2026 referenced above connects to broader algorithmic-governance developments that would, in a fuller cycle, also be relevant to the artificial-intelligence monitor's coverage; this brief addresses only the data-protection dimension of that draft Bill.

Outlook

Whether the Data Protection Amendment Bill and the Artificial Intelligence Bill 2026 progress beyond their current drafting or proposed stage is the central open question carried into the next cycle. The unresolved status of the Kenya-EU adequacy dialogue, launched in May 2024, also remains a gap: no confirmation of its current substantive status as of September 2026 was available this cycle. Continued ODPC enforcement activity, following the pattern set by the Regus Kenya determination and the 2025 complaint volume, is likely to remain the most concrete near-term signal to track.

2 earlier updates not shown here.

Standing brief · as of 25 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Kenya's data-protection enforcement posture has escalated sharply into 2026. The Office of the Data Protection Commissioner has moved from an awareness-building phase into a structured regime of regulator-led audits, compensation orders and court-enforced deletion mandates. The clearest evidence of this shift is quantitative: in January 2026 alone, the ODPC issued 184 compensation orders, part of a broader enforcement record that includes over 9,061 complaints received, 357 determinations, 134 enforcement notices and 20 penalty notices. This places Kenya among the more active data-protection enforcement regimes on the African continent by volume, a materially different posture from the Office's earlier awareness-led approach. This enforcement intensification sits alongside a standing structural feature of the Act: the Data Protection Act, 2019 applies extraterritorially to any organisation processing the personal data of individuals located in Kenya, regardless of where that organisation is based, capturing foreign companies that offer goods or services to, or monitor, Kenyan residents. Combined with the ODPC's newly assertive enforcement posture, that extraterritorial reach means foreign-domiciled organisations serving Kenyan users can no longer treat Kenya's data-protection regime as a low-enforcement-risk jurisdiction.

Other Developments

A pending amendment bill would raise financial exposure. The Data Protection Act, 2019's administrative penalty ceiling currently allows the ODPC to impose a fine of up to KES 5 million or 1% of annual turnover, whichever is lower; the Data Protection (Amendment) Bill 2025 proposes flipping this calculation to whichever is higher, which would substantially increase exposure for large organisations. The same bill would broaden standing to file complaints beyond data subjects to any person, and would expand the categories of sensitive data to include political opinions and trade union membership, aligning Kenya's special-category regime more closely with the structure of GDPR Article 9. None of these amendments are yet enacted.

Data subject rights await a dedicated appeals forum. The same Amendment Bill 2025 would establish a Data Protection Appeals Tribunal required to resolve complaints within 60 days, a potentially significant improvement in redress speed relative to the current complaints pathway through the ODPC itself, though this too remains pending enactment.

A parallel cybersecurity regime has been assented. The Computer Misuse and Cybercrimes (Amendment) Act 2024, assented 15 October 2025, targets SIM-swap fraud, phishing, identity theft and online harassment, and adds a parallel cybersecurity regime alongside the Data Protection Act 2019, including a tighter 24-hour breach-notification clock for critical-infrastructure operators, distinct from the Data Protection Act's own 72-hour controller and 48-hour processor notification windows.

Biometric governance is contested from two directions at once. A Kenyan court ordered the deletion of biometric data that had been collected without a sufficient lawful basis, one of the most significant judicial enforcement actions taken under the Data Protection Act 2019 to date. At the same time, the Kenya Information and Communications (Amendment) Bill 2025, under parliamentary review as of May 2026, would empower the Cabinet Secretary to mandate that internet service providers install real-time surveillance tools, and would separately require ISPs to assign each subscriber a unique trackable meter number tied to detailed personal data submitted to the Communications Authority of Kenya. Civil-society body ICJ Kenya has described the Bill as a potential vehicle for mass surveillance.

Cross-Monitor Connections

The Kenya Information and Communications (Amendment) Bill 2025's subscriber-tracking and surveillance-tooling provisions sit at the intersection of this monitor's algorithmic and surveillance-governance coverage and the world-payments monitor's tracking of Kenya's telecommunications-adjacent financial infrastructure, to the extent that subscriber identity data increasingly underpins mobile-money authentication; that payments-infrastructure angle is not analysed independently here. The Computer Misuse and Cybercrimes (Amendment) Act's tighter 24-hour breach clock for critical-infrastructure operators additionally overlaps with sector-specific obligations that financial-sector regulators impose on banks and payment providers, an intersection this brief flags without analysing the payments-regulatory detail, which sits outside this monitor's scope. Separately, financial-integrity's coverage of Kenya's beneficial-ownership and virtual-asset-service-provider obligations touches data-handling questions, such as customer due-diligence data retention, that are adjacent to but distinct from the controller/processor duties addressed in this brief.

Outlook

The Data Protection (Amendment) Bill 2025 is the single most consequential pending development to track: its enactment, expected around the first quarter of 2027, would simultaneously raise ODPC's penalty ceiling, broaden complaints standing, expand special-category data, and establish a new Appeals Tribunal required to resolve complaints within 60 days. On a shorter horizon, the Kenya Information and Communications (Amendment) Bill 2025's progress through Parliament, expected to develop over the next two quarters, is the marker to watch for whether Kenya's surveillance-governance trajectory tilts toward the mass-surveillance model civil society has warned against, or is moderated during the legislative process. The court's biometric-deletion order stands, for now, as a counterweight demonstrating that judicial enforcement under the existing Act remains active even as the legislative surveillance debate continues.

trust tier: ai_unverified

Latest update · 28 September 2026

Regulatory Status

Kenya's data-protection regime is understood to have shifted in 2026 from an awareness-and-voluntary-compliance posture toward a more operationalised enforcement environment, with the Office of the Data Protection Commissioner conducting audits, issuing compensation orders, and a court reportedly ordering deletion of unlawfully collected biometric data. The ODPC determined 96 complaints in 2025 under penalties of up to KES 5 million or 1% of annual turnover, and the High Court upheld the ODPC's findings in Regus Kenya Limited v Data Protection Commissioner [2025] eKLR while moderating the penalty for a first-time offender. New ODPC Guidance Notes for Cross-Border Data Transfers were issued in 2026, and Kenya's Data Protection Act's close alignment with the GDPR is reported to support Kenya's position in an ongoing, unconcluded EU adequacy dialogue. A Data Protection Amendment Bill, reported to propose expanded ODPC penalty powers and a draft Artificial Intelligence Bill 2026 modelled in part on the EU AI Act, both remain at uncertain or proposed legislative stages.

10 of 10 categories

Signal

Density

Selections OR within a group, AND across groups. Press / to search.

#

Statute in force and regulator active/enforcing since 2021-2022, but core implementing instruments (SCC-equivalent forms, adequacy decisions) remain absent, and the ODPC's independence/resourcing has been publicly questioned.

Primary frameworkData Protection Act, 2019 (Kenya)

Supervisory authorityOffice of the Data Protection Commissioner (ODPC)

Traffic-light rationale — AmberStatute in force and regulator active/enforcing since 2021-2022, but core implementing instruments (SCC-equivalent forms, adequacy decisions) remain absent, and the ODPC's independence/resourcing has been publicly questioned.

Sub-modules (5)

Regulator And AuthorityAmber

The ODPC, headed by the Data Protection Commissioner, oversees implementation and enforcement of the Act under Section 8; the first Commissioner was sworn in November 2020, more than a year after the Act commenced.

Claims (1):

The Data Protection Commissioner oversees implementation and enforcement of the Act under Section 8, but the office remained unformed until Immaculate Kassait was sworn in as Kenya's first Data Commissioner on 16 November 2020.

Act And InstrumentsGreen

The Data Protection Act, 2019 came into force 25 November 2019 as Kenya's primary DP legislation, supplemented by the Data Protection (General) Regulations, (Registration of Data Controllers and Data Processors) Regulations, and (Compliance and Enforcement) Regulations, all 2021.

Claims (1):

The Data Protection Act, 2019 came into force on 25 November 2019 and is the primary data protection legislation in Kenya.

Material ScopeGreen

The Act covers processing of 'personal data' and imposes enhanced rules on 'sensitive personal data', defined broadly to include race, health status, ethnic/social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (including children's/parents'/spouse's names), sex, and sexual orientation.

Claims (1):

Sensitive personal data under the Act includes race, health status, ethnic/social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (names of children, parents, spouses), sex and sexual orientation.

Territorial ScopeGreen

The Act applies extraterritorially: it covers any controller/processor established or resident in Kenya processing data while in Kenya, and also any controller/processor not established in Kenya but processing personal data of data subjects located in Kenya.

Claims (1):

The Act applies to controllers/processors established or resident in Kenya, and separately to controllers/processors not established or resident in Kenya but who process personal data of data subjects located in Kenya, giving it broader extraterritorial reach than the GDPR's establishment-based test.

Regulator Registration And FilingAmber

Section 18 prohibits acting as a controller/processor unless registered with the Data Commissioner; the Registration Regulations 2021 set turnover/employee-based exemption thresholds (below KES 5 million turnover or under 10 employees) but registration remains mandatory regardless of size for specified high-risk activities. Registration opened 14 July 2022.

Claims (2):

Section 18 provides no person shall act as a data controller or data processor unless registered with the Data Commissioner, who prescribes mandatory-registration thresholds considering industry nature, data volumes processed, and whether sensitive personal data is processed.
The Registration Regulations exempt controllers/processors with annual turnover below KES 5 million or fewer than 10 employees from registration, but registration remains mandatory regardless of size for specified high-risk processing activities; online/physical registration opened 14 July 2022.

Category narrative135 words

Kenya's Data Protection Act, 2019 (DPA) is the primary omnibus instrument, enacted to give effect to the constitutional right to privacy under Article 31(c) and (d) of the Constitution. It closely mirrors GDPR concepts but substitutes GDPR-style record-keeping (Art 30 ROPA) with a mandatory registration/certification regime for controllers and processors. The Office of the Data Protection Commissioner (ODPC) was formally activated only after the first Commissioner, Immaculate Kassait, was sworn in on 16 November 2020 -- over a year after the Act's commencement -- and the operative subsidiary regulations (General, Registration, and Compliance & Enforcement Regulations) were only finalised in 2021 with registration opening in July 2022. The regime is therefore treated as in_transition: the statute and ODPC are operative and actively enforcing, but several implementing mechanisms (e.g. approved SCC-equivalents, formal adequacy determinations) remain undeveloped.

Periodic update · new data 2026-09-28

Regulator & Framework

Kenya's Office of the Data Protection Commissioner is understood to have moved, over the course of 2026, beyond an awareness-campaign and voluntary-compliance posture into a structured regime of regulator-led audits, compensation orders and court-enforced deletion mandates. This is a probable characterisation of the ODPC's shifting institutional posture rather than a confirmed, formally announced policy change, and it should be read as reflecting an operational shift in enforcement intensity rather than a change in the underlying Data Protection Act, 2019 itself.

A Data Protection Amendment Bill is separately reported to propose expanded ODPC penalty powers and enhanced ODPC training and accreditation authority. Its status as of early-to-mid 2026 was described as pending legislative consideration, and whether it has since been tabled or passed, or remains at drafting stage, could not be confirmed this cycle. Any assessment of the ODPC's future powers should therefore treat this Bill as a proposed rather than settled development.

Outlook

The central open question for this module is whether the Data Protection Amendment Bill progresses beyond its currently uncertain legislative status. Continued observation of ODPC audit and enforcement activity, discussed further under Enforcement & Redress, will be the clearest available evidence of whether the reported shift toward a more operationalised compliance posture continues.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (6)

ConfirmedInternational Association of Privacy Professionals — The Data Protection Commissioner oversees implementation and enforcement of the Act under Section 8, but the office remained unformed until Immaculate Kassait was sworn in as Kenya's first Data Commissioner on 16 November 2020.observed 2026-08-05
ConfirmedOneTrust DataGuidance — The Data Protection Act, 2019 came into force on 25 November 2019 and is the primary data protection legislation in Kenya.observed 2026-08-05
ConfirmedOneTrust DataGuidance — Sensitive personal data under the Act includes race, health status, ethnic/social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (names of children, parents, spouses), sex and sexual orientation.observed 2026-08-05
ConfirmedOneTrust DataGuidance — The Act applies to controllers/processors established or resident in Kenya, and separately to controllers/processors not established or resident in Kenya but who process personal data of data subjects located in Kenya, giving it broader extraterritorial reach than the GDPR's establishment-based test.observed 2026-08-05
ConfirmedInternational Association of Privacy Professionals — Section 18 provides no person shall act as a data controller or data processor unless registered with the Data Commissioner, who prescribes mandatory-registration thresholds considering industry nature, data volumes processed, and whether sensitive personal data is processed.observed 2026-08-05
Confirmedunavailable — The Registration Regulations exempt controllers/processors with annual turnover below KES 5 million or fewer than 10 employees from registration, but registration remains mandatory regardless of size for specified high-risk processing activities; online/physical registration opened 14 July 2022.

#

Core lawful-basis and special-category framework is legislated and in force, closely tracking GDPR structure.

Primary frameworkData Protection Act, 2019 (Kenya); Data Protection (General) Regulations, 2021

Supervisory authorityOffice of the Data Protection Commissioner (ODPC)

Traffic-light rationale — GreenCore lawful-basis and special-category framework is legislated and in force, closely tracking GDPR structure.

Sub-modules (4)

Lawful BasesGreen

The Act sets out legal bases for processing personal and sensitive data broadly similar to GDPR Art 6/9; the General Regulations 2021 require reliance on only one legal basis, established before processing begins.

Claims (2):

The GDPR and the Act set out very similar legal bases for processing both personal data and sensitive data, with comparable conditions of consent and exceptions for journalism or artistic purposes.
Under the Data Protection (General) Regulations, 2021, processing may rely on only one legal basis at a time, which must be established before the processing begins.

Special CategoriesGreen

Section 45 imposes specific requirements for processing sensitive personal data, with protective measures required and a broader sensitive-data definition than GDPR (e.g., including family members' names).

Claims (2):

Sensitive personal data under the Act includes race, health status, ethnic/social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (names of children, parents, spouses), sex and sexual orientation.
Section 45 of the Act sets out specific protective requirements for the processing of sensitive personal data.

Pseudonymisation And AnonymisationGreen

Both the Act and GDPR explicitly recognise anonymised and pseudonymised data and apply comparable concepts to automated processing, though definitional nuances differ (e.g., what counts as identifying data).

Claims (1):

The GDPR and the Act both explicitly consider anonymised and pseudonymised data and apply to automated processing, with comparable concepts of personal and sensitive data, though key differences exist in how anonymisation is defined.

Category narrative79 words

The Act sets out lawful bases for both ordinary and sensitive personal data broadly comparable to GDPR Art 6/9, and the General Regulations 2021 require that processing rely on a single legal basis established prior to processing. Section 45 imposes enhanced protective requirements for sensitive personal data. Consent standards and journalism/artistic-purpose exceptions mirror GDPR, though withdrawal-of-consent and contract-performance nuances differ. Anonymisation/pseudonymisation are recognised concepts, similar to GDPR, though defined with some differences (e.g. family-member names counted as personal data).

No new data since the standing brief. 1 periodic run re-emitted it unchanged.

Sources and claims (5)

ConfirmedOneTrust DataGuidance — The GDPR and the Act set out very similar legal bases for processing both personal data and sensitive data, with comparable conditions of consent and exceptions for journalism or artistic purposes.observed 2026-08-05
Confirmedunavailable — Under the Data Protection (General) Regulations, 2021, processing may rely on only one legal basis at a time, which must be established before the processing begins.
ProbableOneTrust DataGuidance — There are slight differences between GDPR and the Act regarding withdrawal of consent and consent tied to performance of a contract.observed 2026-08-05
ConfirmedOneTrust DataGuidance — Section 45 of the Act sets out specific protective requirements for the processing of sensitive personal data.observed 2026-08-05
ConfirmedOneTrust DataGuidance — The GDPR and the Act both explicitly consider anonymised and pseudonymised data and apply to automated processing, with comparable concepts of personal and sensitive data, though key differences exist in how anonymisation is defined.observed 2026-08-05

#

Rights exist and are being enforced via ODPC orders, but the Act is comparatively thin on granular procedural mechanics/response deadlines for controllers.

Primary frameworkData Protection Act, 2019 (Kenya)

Supervisory authorityOffice of the Data Protection Commissioner (ODPC)

Traffic-light rationale — AmberRights exist and are being enforced via ODPC orders, but the Act is comparatively thin on granular procedural mechanics/response deadlines for controllers.

Sub-modules (5)

Access RightAmber

The Act provides an access right but with less detailed procedural guidance than GDPR on the exercise of data subject rights.

Claims (1):

The Act provides less detailed information than the GDPR on the exercise of data subject rights.

Rectification And ErasureAmber

ODPC enforcement action confirms an operative erasure/rectification expectation: Platinum Credit was found to have failed to erase a complainant's data on request, and Nairobi Hospital was ordered to delete unlawfully obtained promotional recordings within 14 days.

Claims (2):

The ODPC found Platinum Credit Limited violated the Act by using personal data for commercial purposes without consent, ignoring the complainant's objection to marketing messages, and failing to erase the complainant's data, ordering KES 900,000 in compensation.
The ODPC ordered The Nairobi Hospital to delete unlawfully-used promotional advertisements containing a patient's covertly recorded image and to provide proof of deletion within 14 days, alongside a KES 500,000 fine, for violations of Sections 32(1) and 37 of the Act.

Restriction And ObjectionAmber

The right to object to processing (particularly direct marketing) is enforced in practice; Platinum Credit was sanctioned for ignoring a complainant's objection to marketing messages.

Claims (1):

The ODPC found Platinum Credit Limited violated the Act by using personal data for commercial purposes without consent, ignoring the complainant's objection to marketing messages, and failing to erase the complainant's data, ordering KES 900,000 in compensation.

Data PortabilityRed

No specific enforcement action or detailed portability mechanic was identified in available sources beyond the Act's general rights framework.

Absence provenance: unavailable. Searched: Kenya Data Protection Act data portability right mechanics.

Deadlines And Response WindowsAmber

No explicit statutory controller-response deadline for subject access/rectification/erasure requests (analogous to GDPR's one-month rule) was located; the only concrete procedural deadline identified is the ODPC's own 90-day complaint-resolution timeline under the Compliance and Enforcement Regulations, guided by the Fair Administrative Action Act 2015.

Absence provenance: unavailable. Searched: Kenya Data Protection Act subject access request response deadline, Data Protection General Regulations 2021 response window.

Claims (1):

The Compliance and Enforcement Regulations require the ODPC to be guided by the Fair Administrative Action Act, 2015, which requires conclusion of complaints within 90 days.

Category narrative70 words

The Act provides data subject rights but with less procedural detail than the GDPR. Enforcement practice (e.g. the Platinum Credit and Nairobi Hospital decisions) shows the ODPC actively enforcing objection-to-marketing and erasure/consent rights. No explicit statutory SAR response-window analogous to GDPR's one-month rule was located in available sources; the clearest procedural deadline identified relates to ODPC's own complaint resolution (90 days) rather than a controller's response to a data-subject request.

Periodic update · new data 2026-09-21

Data Subject Rights

Kenya's approach to enforcing data subject rights is understood to have strengthened operationally in 2026. The Office of the Data Protection Commissioner is reported to have operationalised court-enforced data-deletion mandates alongside compliance audits and compensation orders, a shift beyond what had previously been a more awareness- and registration-focused enforcement posture. This is a probable-confidence finding, sourced from secondary legal commentary rather than a primary ODPC rulemaking or policy document, but it describes a meaningful operational change: the erasure right is understood to now be backed by judicial enforcement mechanisms rather than resting solely on administrative complaint-handling.

This development should be read as a strengthening of the practical exercise of rights already established under the Data Protection Act, 2019, rather than as the introduction of a new statutory right. The distinguishing feature this cycle is enforcement mechanism, not legal entitlement: the underlying erasure and rectification rights are pre-existing, but the pathway to their practical vindication is reported to have shifted toward court-enforced outcomes and compensation orders running alongside them.

Outlook

The key indicator to watch is whether specific court-enforced deletion cases become publicly documented through ODPC's Determinations records or through court judgments, which would allow this reported operational shift to be corroborated against primary-source case outcomes rather than resting on secondary commentary alone.

1 earlier distinct update(s)

Periodic update · new data 2026-09-14

Data Subject Rights

ODPC determinations in 2025 are understood to have enforced data-subject erasure and marketing-objection rights concretely, in a matter reported as Bolo v. Platinum Credit, where a company reportedly ignored requests to delete personal data and stop unwanted marketing calls. This finding is reported at Probable confidence from a single secondary source, and represents the clearest evidence this cycle that Kenya's statutory data-subject rights under the Data Protection Act, 2019 are being given operational effect through individual enforcement determinations rather than remaining purely declaratory.

The significance of this development lies less in the specific facts of the individual determination and more in what it signals about ODPC's willingness to act on rights-based complaints, which sits alongside the broader operational shift toward active enforcement documented elsewhere in this cycle's evidence. No further data-subject-rights determinations beyond this single reported matter were retrieved this cycle, and the precise remedial order issued in the case (compensation, deletion mandate, or both) was not fully specified in the available source.

Outlook

Further visibility into the volume and pattern of ODPC data-subject-rights determinations, beyond this single reported case, would help establish whether this is an isolated enforcement action or part of a broader pattern consistent with the operationalised-audit posture documented in the enforcement_and_redress module this cycle.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (4)

ProbableOneTrust DataGuidance — The Act provides less detailed information than the GDPR on the exercise of data subject rights.observed 2026-08-05
ConfirmedOneTrust DataGuidance — The ODPC found Platinum Credit Limited violated the Act by using personal data for commercial purposes without consent, ignoring the complainant's objection to marketing messages, and failing to erase the complainant's data, ordering KES 900,000 in compensation.observed 2026-08-05
ConfirmedOneTrust DataGuidance — The ODPC ordered The Nairobi Hospital to delete unlawfully-used promotional advertisements containing a patient's covertly recorded image and to provide proof of deletion within 14 days, alongside a KES 500,000 fine, for violations of Sections 32(1) and 37 of the Act.observed 2026-08-05
ConfirmedOneTrust DataGuidance — The Compliance and Enforcement Regulations require the ODPC to be guided by the Fair Administrative Action Act, 2015, which requires conclusion of complaints within 90 days.observed 2026-08-05

#

Core accountability, DPIA, and breach-notification duties are legislated and enforced, but DPO mandate is non-binding in practice and ROPA/joint-controller mechanics are comparatively underdeveloped versus GDPR.

Primary frameworkData Protection Act, 2019 (Kenya); Data Protection (General) Regulations, 2021

Supervisory authorityOffice of the Data Protection Commissioner (ODPC)

Traffic-light rationale — AmberCore accountability, DPIA, and breach-notification duties are legislated and enforced, but DPO mandate is non-binding in practice and ROPA/joint-controller mechanics are comparatively underdeveloped versus GDPR.

Sub-modules (7)

Accountability And DpiaGreen

Section 31 requires DPIAs for processing operations likely to result in high risk to data subjects, including biometric or genetic data processing and profiling/algorithmic ADM with legal or significant effect; where Commissioner consultation is required, it must occur within 60 days.

Claims (3):

Regulation 49 of the Data Protection (General) Regulations requires a DPIA to be conducted under Section 31 of the Act for processing operations considered to result in high risks to the rights and freedoms of a data subject, including biometric or genetic data processing.
Where a controller is required to consult the Data Commissioner on a DPIA, they must do so within 60 days.
The General Regulations designate biometric-data processing and automated decision-making with legal or other significant effect using profiling or algorithmic means as DPIA-triggering activities.

Dpo RequirementsAmber

The Act's DPO provisions mirror GDPR concepts and tasks but use permissive ('may') rather than mandatory ('shall') language, meaning appointment depends on the controller/processor's specific conditions and activities; where appointed, DPO contact details must be communicated to the Commissioner and published on the controller/processor's website.

Claims (2):

DPO concepts, tasks, and appointment provisions are similar between GDPR and the Act, but the Act uses permissive terms such as 'may' rather than 'shall', making DPO appointment conditional rather than a strict mandate.
Where appointed, the DPO's contact details must be communicated to the Commissioner and published on the official website of the data controller or data processor.

Ropa RequirementsAmber

Unlike the GDPR's Article 30 record-keeping obligation, the Act substitutes a registration/notification regime with the Data Commissioner rather than requiring internal records of processing activities.

Claims (1):

Unlike the GDPR, the Act establishes general processing registration/notification requirements rather than explicit internal record-keeping obligations for controllers and processors.

Joint Controller ArrangementsRed

No specific statutory provisions were identified governing the management of joint controller/processor relationships; service providers are only required to ensure contracted third parties adhere to data-protection provisions generally.

Claims (1):

There are no legal provisions specifically governing the management of the data controller and data processor relationship under Kenyan sectoral telecoms rules, though service providers must ensure contracted third parties adhere to data-protection provisions.

Security MeasuresGreen

The Act and General Regulations establish privacy-by-design/by-default principles broadly similar to GDPR, requiring embedded technical and organisational measures.

Claims (1):

The Act and GDPR have broadly similar security requirements, both establishing principles of privacy by default and by design, operationalised in Kenya via the General Regulations' technical and organisational measures requirements.

Breach NotificationGreen

Controllers must notify the Commissioner within 72 hours of a breach presenting real risk of harm to data subjects, and must subsequently notify affected data subjects in writing; the General Regulations set out categories of notifiable breaches and required notification content.

Claims (2):

Controllers and processors must notify the Commissioner within 72 hours of any breach where there is a real risk of harm to data subjects, comparable to the GDPR's breach-notification timeline.
Where there is real risk of harm to data subjects from a breach, controllers must notify affected data subjects in writing after first notifying the Commissioner.

Retention And DisposalRed

No explicit statutory retention-period schedule or disposal-duty provision specific to Kenya was located in available sources beyond general storage-limitation principles implied by the Act's data protection principles.

Absence provenance: unavailable. Searched: Kenya Data Protection Act retention period disposal obligations, Kenya General Regulations 2021 data retention.

Category narrative69 words

Kenya's General Regulations 2021 operationalise accountability via privacy-by-design/default obligations, mandatory DPIAs for high-risk processing (including biometric/genetic data and profiling-based ADM), and 72-hour breach notification to the ODPC. DPO appointment exists conceptually but is framed permissively ('may' rather than 'shall'), making it conditional rather than a hard threshold-based mandate. The Act substitutes formal ROPA/record-keeping with a registration regime, and a documented gap exists in statutory provisions governing controller-processor contractual relationships.

Periodic update · new data 2026-09-28

Controller/Processor Duties

Under the Data Protection Act, 2019, breaches must be notified within 72 hours to the ODPC, with a shorter 24-hour notification window applying to designated critical-infrastructure operators. This tiered notification structure reflects a risk-differentiated approach to breach-notification timing that predates this cycle's enforcement developments but remains the operative standard against which 2026 enforcement activity should be read.

Reports suggest a Kenyan court ordered the deletion of biometric data that had been collected without a sufficient lawful basis, an intervention described as one of the most significant judicial data-protection enforcement moments of this cycle. Because this claim rests on Uncertain-confidence secondary reporting rather than a primary judicial record, it should be read as an attributed development rather than a confirmed judicial finding — a court is reported to have taken this action, but the underlying judgment itself has not been independently verified this cycle.

Taken together, the breach-notification framework and the reported biometric-deletion order point toward a controller/processor compliance environment in which retention and disposal practices, and the underlying lawful-basis question for sensitive data such as biometrics, are receiving active regulatory and judicial attention in 2026.

Outlook

Confirmation of the underlying judicial record behind the reported biometric-data deletion order, and any pattern of similar interventions concerning lawful basis for sensitive-data collection, are the developments to track for this module going forward.

1 earlier distinct update(s)

Periodic update · new data 2026-09-21

Controller/Processor Duties

Kenya's compliance-audit regime for controllers and processors is reported to be fully operational in 2026, with a documented set of audit triggers: individual complaints, risk-based sectoral targeting concentrated on financial services and health-technology, random selection from ODPC's register of data controllers and processors, enforcement-notice follow-up, and referral from bodies such as the Office of the Auditor General. This is a probable-confidence finding drawn from secondary legal commentary, and it represents a materially more systematic audit-trigger taxonomy than a purely complaint-reactive model would imply.

ODPC is understood to operate a public registration portal functioning also as a register of data controllers and processors, which supports the random-selection audit-trigger mechanism described above. This registration and register function has probable-confidence, sourced from industry-body commentary, and it sits alongside the individual-complaint and referral-based audit triggers as one of several distinct routes into ODPC compliance-audit scrutiny.

What remains genuinely unconfirmed this cycle is whether the previously-proposed Data Protection Compliance Audit Regulations, 2024 have since been finalised and gazetted. If they have not, the audit-trigger taxonomy described above would rest on ODPC administrative practice rather than on a codified regulatory instrument, a distinction that matters for controllers seeking to understand the legal basis of an audit they might face.

Outlook

Watch for confirmation of whether the Data Protection Compliance Audit Regulations, 2024 have been finalised and gazetted, since that would clarify whether the current audit-trigger taxonomy operates on a formal regulatory basis or as ODPC administrative practice pending such codification.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (10)

ConfirmedInternational Association of Privacy Professionals — Regulation 49 of the Data Protection (General) Regulations requires a DPIA to be conducted under Section 31 of the Act for processing operations considered to result in high risks to the rights and freedoms of a data subject, including biometric or genetic data processing.observed 2026-08-05
ConfirmedInternational Association of Privacy Professionals — Where a controller is required to consult the Data Commissioner on a DPIA, they must do so within 60 days.observed 2026-08-05
ProbableOneTrust DataGuidance — The General Regulations designate biometric-data processing and automated decision-making with legal or other significant effect using profiling or algorithmic means as DPIA-triggering activities.observed 2026-08-05
ProbableOneTrust DataGuidance — DPO concepts, tasks, and appointment provisions are similar between GDPR and the Act, but the Act uses permissive terms such as 'may' rather than 'shall', making DPO appointment conditional rather than a strict mandate.observed 2026-08-05
ProbableOneTrust DataGuidance — Where appointed, the DPO's contact details must be communicated to the Commissioner and published on the official website of the data controller or data processor.observed 2026-08-05
ConfirmedOneTrust DataGuidance — Unlike the GDPR, the Act establishes general processing registration/notification requirements rather than explicit internal record-keeping obligations for controllers and processors.observed 2026-08-05
ProbableOneTrust DataGuidance — There are no legal provisions specifically governing the management of the data controller and data processor relationship under Kenyan sectoral telecoms rules, though service providers must ensure contracted third parties adhere to data-protection provisions.observed 2026-08-05
ConfirmedOneTrust DataGuidance — The Act and GDPR have broadly similar security requirements, both establishing principles of privacy by default and by design, operationalised in Kenya via the General Regulations' technical and organisational measures requirements.observed 2026-08-05
ConfirmedOneTrust DataGuidance — Controllers and processors must notify the Commissioner within 72 hours of any breach where there is a real risk of harm to data subjects, comparable to the GDPR's breach-notification timeline.observed 2026-08-05
ConfirmedOneTrust DataGuidance — Where there is real risk of harm to data subjects from a breach, controllers must notify affected data subjects in writing after first notifying the Commissioner.observed 2026-08-05

#

Transfer mechanisms exist in principle but lack a developed adequacy/SCC infrastructure, and sectoral/strategic-interest data localisation mandates add complexity and legal uncertainty (as illustrated by ongoing Worldcoin litigation).

Primary frameworkData Protection Act, 2019 (Kenya), Part VII; Data Protection (General) Regulations, 2021

Supervisory authorityOffice of the Data Protection Commissioner (ODPC)

Traffic-light rationale — AmberTransfer mechanisms exist in principle but lack a developed adequacy/SCC infrastructure, and sectoral/strategic-interest data localisation mandates add complexity and legal uncertainty (as illustrated by ongoing Worldcoin litigation).

Sub-modules (6)

Transfer MechanismsAmber

Cross-border transfer of personal data is permitted based on appropriate safeguards, an ODPC adequacy decision, necessity, or data-subject consent; written cross-border transfer agreements and restrictions on further onward transfer are also required.

Claims (2):

Transfer of personal data outside Kenya is restricted to instances involving appropriate data protection safeguards, an ODPC adequacy decision, necessity, or data-subject consent.
The General Regulations require written cross-border transfer agreements between sending and receiving entities, along with restrictions on further onward transfer of personal data.

Adequacy ReceivedRed

No information was identified indicating any jurisdiction has issued an adequacy decision recognising Kenya's regime as adequate.

Absence provenance: unavailable. Searched: Kenya adequacy decision received EU UK, Kenya DPA adequacy status.

Adequacy GrantedRed

There is currently no adequacy agreement between Kenya and the U.S. or any other country for personal data transfers, and the ODPC has not issued formal adequacy decisions for outbound transfers to specific jurisdictions.

Claims (1):

There is currently no adequacy agreement between Kenya and the United States, or any other country, for personal data transfers, and standard contractual clauses have not been provided under the Act or approved by the ODPC.

Sccs And BcrsRed

Unlike the GDPR, standard contractual clauses have not been provided under the Act or approved by the ODPC; the Act instead relies on the Commissioner-assessed 'appropriate safeguards' concept, which is undefined in the statute itself.

Claims (2):

There is currently no adequacy agreement between Kenya and the United States, or any other country, for personal data transfers, and standard contractual clauses have not been provided under the Act or approved by the ODPC.
The Act generally requires data controllers or processors to demonstrate to the Data Commissioner that appropriate safeguards exist, unless consent has been obtained, but the Act does not explicitly define what constitutes 'appropriate safeguards'.

Transfer Impact AssessmentAmber

Regulation 41(1) of the General Regulations requires demonstrating that a legal instrument binding the recipient provides protection 'essentially equivalent' to the Act, or that a robust assessment of transfer circumstances concludes appropriate safeguards exist -- a GDPR-TIA-like exercise, though without a codified formal TIA methodology.

Claims (1):

Under Regulation 41(1) of the General Regulations, the appropriate-safeguards basis for transfer requires a legal instrument binding the recipient that is 'essentially equivalent' to protection under the Act, or a robust assessment concluding appropriate safeguards exist.

Data LocalisationAmber

Section 50 empowers the Cabinet Secretary to mandate that certain processing (on strategic-interest or revenue-protection grounds) occur only via a server/data centre located in Kenya; the General Regulations extend this to specified sectors (civil registration, elections, public finance, critical infrastructure, education, healthcare), requiring at least one servicing data copy be stored in Kenya.

Claims (2):

Section 50 of the Act allows the Cabinet Secretary to prescribe, on grounds of strategic interests of the state or protection of revenue, that certain processing be effected only through a server or data centre located in Kenya.
The General Regulations require controllers/processors handling data for strategic state interests -- including civil registration, elections, public finance, critical infrastructure, basic education, and healthcare -- to process such data via a Kenya-located server/data centre and store at least one servicing copy in Kenya.

Category narrative52 words

Kenya and the EU are in the final stages of a mutual data-adequacy negotiation launched in May 2024. President Ruto set September 2026 as a political target for finalisation at a Brussels meeting with EVP Henna Virkkunen on 8 June 2026; no adequacy decision had been formally adopted as of this cycle.

Periodic update · new data 2026-09-28

Cross-Border & Adequacy

The ODPC issued Guidance Notes for Cross-Border Data Transfers in 2026, setting duties for controllers and processors around lawful cross-border transfer conditions and mandatory registration. This is a primary-source regulatory development, published directly by the ODPC, and represents the clearest first-party evidence of movement in this module this cycle.

Separately, and resting on lower-tier secondary commentary, Kenya's Data Protection Act is reported to closely mirror the GDPR, a structural similarity said to position Kenya for a potential positive EU adequacy determination. As of early 2026 reporting, the Kenya-EU adequacy dialogue — understood to have launched in May 2024 — remained ongoing without a concluded decision, and this cycle's research could not confirm the dialogue's current substantive status as of September 2026. This should be read as an open, unresolved question rather than a settled position in either direction.

Also resting on secondary commentary, the ODPC's Cloud Policy is reported to encourage data localisation when entities adopt cloud solutions, with particular emphasis on sensitive government and critical-infrastructure data. This localisation encouragement is described in attributed terms only, reflecting the Uncertain confidence attached to the underlying source.

Outlook

The unresolved status of the Kenya-EU adequacy dialogue is the central gap to close in future cycles. Confirmation of the dialogue's current substantive status, and any further detail on how the new Cross-Border Guidance Notes interact with the reported cloud-localisation encouragement, would materially sharpen this module's picture.

Sources and claims (7)

ConfirmedOneTrust DataGuidance — Transfer of personal data outside Kenya is restricted to instances involving appropriate data protection safeguards, an ODPC adequacy decision, necessity, or data-subject consent.observed 2026-08-05
ConfirmedOneTrust DataGuidance — The General Regulations require written cross-border transfer agreements between sending and receiving entities, along with restrictions on further onward transfer of personal data.observed 2026-08-05
ConfirmedInternational Association of Privacy Professionals — There is currently no adequacy agreement between Kenya and the United States, or any other country, for personal data transfers, and standard contractual clauses have not been provided under the Act or approved by the ODPC.observed 2026-08-05
ConfirmedOneTrust DataGuidance — The Act generally requires data controllers or processors to demonstrate to the Data Commissioner that appropriate safeguards exist, unless consent has been obtained, but the Act does not explicitly define what constitutes 'appropriate safeguards'.observed 2026-08-05
ConfirmedInternational Association of Privacy Professionals — Under Regulation 41(1) of the General Regulations, the appropriate-safeguards basis for transfer requires a legal instrument binding the recipient that is 'essentially equivalent' to protection under the Act, or a robust assessment concluding appropriate safeguards exist.observed 2026-08-05
ConfirmedOneTrust DataGuidance — Section 50 of the Act allows the Cabinet Secretary to prescribe, on grounds of strategic interests of the state or protection of revenue, that certain processing be effected only through a server or data centre located in Kenya.observed 2026-08-05
ConfirmedOneTrust DataGuidance — The General Regulations require controllers/processors handling data for strategic state interests -- including civil registration, elections, public finance, critical infrastructure, basic education, and healthcare -- to process such data via a Kenya-located server/data centre and store at least one servicing copy in Kenya.observed 2026-08-05

#

Multiple sectoral overlays exist and interact with the DPA (telecoms, payments, health), but coverage is uneven and some sectors (education, insurance) show no distinct DP overlay in available sources.

Primary frameworkData Protection Act, 2019 (Kenya); Kenya Information and Communications Act, 1998; National Payment System Act

Supervisory authorityOffice of the Data Protection Commissioner (ODPC)

Traffic-light rationale — AmberMultiple sectoral overlays exist and interact with the DPA (telecoms, payments, health), but coverage is uneven and some sectors (education, insurance) show no distinct DP overlay in available sources.

Sub-modules (7)

Financial Sector OverlayAmber

Financial data is regulated under the National Payment System Act, National Payment Regulations, and Prudential Guidelines, layered atop general DPA obligations.

Claims (1):

Financial data in Kenya is regulated under the National Payment System Act, National Payment Regulations, and Prudential Guidelines, in addition to the general Data Protection Act.

Health Sector OverlayAmber

The (non-binding but persuasive) Health Information System Policy requires that health data not be stored outside Kenyan territory.

Claims (1):

The Health Information System Policy requires health data not be stored outside Kenyan territory; while not legally binding, it is persuasive and courts are likely to be guided by it absent statutory provision.

Telecoms And EprivacyGreen

Licensed providers under KICA must obtain/retain subscriber and SIM-card registration information, keep records secure and confidential, adhere to CA-prescribed retention periods, and ensure processing complies with DPA principles including breach notification to customers for network-security risks.

Claims (2):

Licensed providers under the Kenya Information and Communications Act must obtain and retain SIM-card/subscriber registration information, keep it secure and confidential, and adhere to CA-prescribed retention periods for registration details, call data records and financial information.
The Act amends KICA to require licensed providers to process subscriber personal data in accordance with the Act's principles and to implement technical/organisational measures preventing loss, damage, unauthorised destruction/access, or unlawful processing.

Employment DataAmber

Most employee data is protected as personal/sensitive data under the general Act; no dedicated sectoral employment-data statute was identified, though the cross-cutting Consumer Protection Act provisions may also apply.

Claims (1):

Most data collected from employees in the course of employment is protected as personal data and sensitive data under the general Act, as there is no dedicated sectoral employment-data statute.

Credit And ScoringAmber

The ODPC has actively enforced against credit/lending firms for unlawful marketing and data-erasure failures, as evidenced by the Platinum Credit Limited decision (KES 900,000 compensation order, January 2025).

Claims (1):

The ODPC found Platinum Credit Limited violated the Act by using personal data for commercial purposes without consent, ignoring the complainant's objection to marketing messages, and failing to erase the complainant's data, ordering KES 900,000 in compensation.

EducationRed

No education-sector-specific data protection overlay was identified in available sources.

Absence provenance: unavailable. Searched: Kenya education sector data protection overlay, Kenya student data protection regulations.

InsuranceRed

No insurance-sector-specific data protection overlay was identified in available sources.

Absence provenance: unavailable. Searched: Kenya insurance sector data protection regulations, Kenya IRA data protection overlay.

Category narrative88 words

Telecoms are regulated under the Kenya Information and Communications Act (KICA) and its Consumer Protection/SIM-Card Registration Regulations, overlaying the DPA for licensed providers. Financial data is separately regulated under the National Payment System Act, National Payment Regulations, and Prudential Guidelines. A non-binding Health Information System Policy discourages storing health data outside Kenya. No dedicated employment-sector statute exists; employee data instead falls under the Act's general personal/sensitive-data provisions. Credit-sector enforcement (e.g., Platinum Credit) demonstrates active ODPC oversight of consumer-lending data practices. No education- or insurance-sector-specific DP overlays were identified.

Periodic update · new data 2026-09-21

Sectoral Watch

Financial services and health-technology have been flagged this cycle as the Kenyan sectors facing the highest probability of Office of the Data Protection Commissioner enforcement attention in 2026, alongside a broader category of data-rich sectors including telecommunications, digital platforms and HR outsourcing. This sectoral-risk framing is a probable-confidence finding, sourced from secondary legal commentary rather than a primary ODPC risk-assessment publication, but it aligns with and is reinforced by the reported shift toward risk-based sectoral targeting as one of several ODPC compliance-audit triggers.

The financial-services sectoral flag in particular sits alongside a broader pattern of increased regulatory attention on Kenya's financial sector this cycle across multiple regulatory domains, though this brief does not extend into financial-integrity or payments-specific analysis of that overlap; it notes only that data-protection audit exposure for financial-services controllers and processors should be assessed as a distinct, additional compliance vector alongside sector-specific financial regulation.

Outlook

The indicator to watch is whether the sectoral-targeting signal translates into visible published enforcement outcomes specifically against financial-services or health-tech controllers in ODPC's Determinations records over the coming cycles, which would corroborate this cycle's secondary-sourced sectoral-risk framing with primary enforcement evidence.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (5)

ConfirmedOneTrust DataGuidance — Financial data in Kenya is regulated under the National Payment System Act, National Payment Regulations, and Prudential Guidelines, in addition to the general Data Protection Act.observed 2026-08-05
ProbableOneTrust DataGuidance — The Health Information System Policy requires health data not be stored outside Kenyan territory; while not legally binding, it is persuasive and courts are likely to be guided by it absent statutory provision.observed 2026-08-05
ConfirmedOneTrust DataGuidance — Licensed providers under the Kenya Information and Communications Act must obtain and retain SIM-card/subscriber registration information, keep it secure and confidential, and adhere to CA-prescribed retention periods for registration details, call data records and financial information.observed 2026-08-05
ConfirmedOneTrust DataGuidance — The Act amends KICA to require licensed providers to process subscriber personal data in accordance with the Act's principles and to implement technical/organisational measures preventing loss, damage, unauthorised destruction/access, or unlawful processing.observed 2026-08-05
ProbableOneTrust DataGuidance — Most data collected from employees in the course of employment is protected as personal data and sensitive data under the general Act, as there is no dedicated sectoral employment-data statute.observed 2026-08-05

#

Direct-marketing consent/opt-out rules are legislated and actively enforced, but Kenya has no distinct cookie/tracker, dark-pattern, or cross-context-advertising regime comparable to EU ePrivacy or US state adtech laws.

Primary frameworkData Protection (General) Regulations, 2021

Supervisory authorityOffice of the Data Protection Commissioner (ODPC)

Traffic-light rationale — AmberDirect-marketing consent/opt-out rules are legislated and actively enforced, but Kenya has no distinct cookie/tracker, dark-pattern, or cross-context-advertising regime comparable to EU ePrivacy or US state adtech laws.

Sub-modules (6)

Cookies And TrackersRed

No cookie- or tracker-specific consent regime distinct from the general lawful-basis framework was identified for Kenya.

Absence provenance: unavailable. Searched: Kenya cookie consent law, Kenya ePrivacy equivalent tracker regulation.

Dark PatternsRed

No dark-pattern prohibition specific to Kenyan data protection law was identified.

Absence provenance: unavailable. Searched: Kenya dark patterns data protection prohibition.

Opt Out SignalsAmber

No recognition of technical opt-out signals (e.g., Global Privacy Control, DAA) was identified in Kenyan sources; the General Regulations instead require a 'simplified opt out mechanism' for direct marketing.

Claims (1):

The General Regulations deem personal data used to advance economic/commercial interests or for direct marketing as 'commercial use', permitted only where the data subject was informed at collection, consented, or was offered and did not exercise a simplified opt-out; use for direct marketing without consent is an offence.

Clean Rooms And DcrRed

No clean-room or data-collaboration-room rules were identified for Kenya.

Absence provenance: unavailable. Searched: Kenya data clean room regulation.

Cross Context AdvertisingRed

Kenya's Act has no CPRA-style 'sale' or 'share' concept for cross-context behavioural advertising.

Absence provenance: unavailable. Searched: Kenya cross-context advertising sale share concept data protection.

Direct MarketingAmber

Direct marketing constitutes 'commercial use' of personal data under the General Regulations, requiring the data subject be informed at collection or have consented, with a mandatory simplified opt-out; use for direct marketing without consent is an offence. ODPC enforcement against Platinum Credit (unsolicited marketing) and Nairobi Hospital (unauthorised promotional use of a patient recording) demonstrates active enforcement.

Claims (3):

The General Regulations deem personal data used to advance economic/commercial interests or for direct marketing as 'commercial use', permitted only where the data subject was informed at collection, consented, or was offered and did not exercise a simplified opt-out; use for direct marketing without consent is an offence.
The ODPC found Platinum Credit Limited violated the Act by using personal data for commercial purposes without consent, ignoring the complainant's objection to marketing messages, and failing to erase the complainant's data, ordering KES 900,000 in compensation.
The ODPC ordered The Nairobi Hospital to delete unlawfully-used promotional advertisements containing a patient's covertly recorded image and to provide proof of deletion within 14 days, alongside a KES 500,000 fine, for violations of Sections 32(1) and 37 of the Act.

Category narrative82 words

The General Regulations 2021 create a direct-marketing consent/opt-out regime: commercial use of data (including direct marketing) requires either that the data subject was informed at collection, that consent was obtained, or that a simplified opt-out is offered and not exercised; using data for direct marketing without consent is an offence. ODPC enforcement (Platinum Credit, Nairobi Hospital) confirms active application of these rules. No cookie/tracker-specific ePrivacy-style regime, dark-pattern prohibition, Global-Privacy-Control-style opt-out signal recognition, clean-room rules, or CPRA-style 'sale'/'share' concept was identified for Kenya.

Sources and claims (1)

ConfirmedOneTrust DataGuidance — The General Regulations deem personal data used to advance economic/commercial interests or for direct marketing as 'commercial use', permitted only where the data subject was informed at collection, consented, or was offered and did not exercise a simplified opt-out; use for direct marketing without consent is an offence.observed 2026-08-05

#

Biometric/ADM processing is captured via DPIA triggers and is the subject of active, high-profile enforcement (Worldcoin), but no dedicated AI risk-assessment framework exists and national-security exemptions are broadly drawn.

Primary frameworkData Protection Act, 2019 (Kenya); Data Protection (General) Regulations, 2021

Supervisory authorityOffice of the Data Protection Commissioner (ODPC)

Traffic-light rationale — AmberBiometric/ADM processing is captured via DPIA triggers and is the subject of active, high-profile enforcement (Worldcoin), but no dedicated AI risk-assessment framework exists and national-security exemptions are broadly drawn.

Sub-modules (6)

Profiling RestrictionsAmber

Profiling-based automated decision-making with legal or significant effect is captured as a DPIA-triggering activity, though no standalone Article-22-style restriction/opt-out right distinct from the DPIA requirement was identified.

Claims (1):

The General Regulations designate biometric-data processing and automated decision-making with legal or other significant effect using profiling or algorithmic means as DPIA-triggering activities.

Automated Decision Making TransparencyRed

No explicit ADM-transparency/explanation right distinct from the general DPIA obligation was identified for Kenya.

Absence provenance: unavailable. Searched: Kenya automated decision-making transparency explanation right.

Ai Risk AssessmentsRed

No AI-specific risk-assessment framework (analogous to the EU AI Act) was identified for Kenya; DPIA obligations under the DPA are the closest functional equivalent for high-risk automated processing.

Absence provenance: unavailable. Searched: Kenya AI Act risk assessment law, Kenya artificial intelligence regulation data protection.

Biometric RegimeAmber

Biometric data is treated as sensitive personal data and triggers mandatory DPIA; the Worldcoin case (registration revocation, one-year activity ban, and unresolved cross-border transfer legality for iris-scan data) is the leading enforcement precedent.

Claims (3):

Regulation 49 of the Data Protection (General) Regulations requires a DPIA to be conducted under Section 31 of the Act for processing operations considered to result in high risks to the rights and freedoms of a data subject, including biometric or genetic data processing.
The ODPC revoked Tools For Humanity's registration as a data processor and banned all Worldcoin activities in Kenya for one year, alleging the registration certificate was obtained through misrepresentation or material nondisclosure.
Failure to register or deliberately providing misleading information to the Data Commissioner's office is an offence punishable by a fine not exceeding KES 3 million or imprisonment not exceeding 10 years, or both, with courts additionally empowered to order forfeiture of related equipment.

Genetic DataAmber

Genetic data is classified as sensitive personal data and, like biometric data, triggers mandatory DPIA under Regulation 49.

Claims (1):

Regulation 49 of the Data Protection (General) Regulations requires a DPIA to be conducted under Section 31 of the Act for processing operations considered to result in high risks to the rights and freedoms of a data subject, including biometric or genetic data processing.

State Surveillance CarveoutsRed

The Miscellaneous Amendments Act, 2020 empowers security services to access personal data from any phone or computer, an exemption criticised by civil society as an overly intrusive national-security carve-out relative to constitutional privacy protections.

Claims (1):

Kenya's Miscellaneous Amendments Act of 2020 empowers security services to access personal data from any phone or computer, cited by civil-society analysts as an overly intrusive national-security exemption relative to the DPA framework.

Category narrative89 words

Kenya lacks a dedicated AI-specific statute, but the General Regulations mandate DPIAs for biometric-data processing and for automated decision-making with legal or significant effect using profiling or algorithmic means. The ongoing Worldcoin/Tools For Humanity litigation is Kenya's most significant test case for biometric governance, involving alleged registration-certificate misrepresentation, DPIA adequacy questions, and unresolved cross-border transfer legality for iris-scan biometric data. Separately, the Miscellaneous Amendments Act, 2020 grants security services broad access to personal data from any phone or computer, a state-surveillance carve-out that has drawn criticism as overly intrusive.

Periodic update · new data 2026-09-28

Algorithmic, Biometric & Surveillance Governance

A Kenyan court is reported to have ordered deletion of biometric data collected without a sufficient lawful basis, marking what secondary commentary describes as a significant judicial data-protection enforcement moment in 2026. As this claim rests on Uncertain-confidence sourcing, it is presented here as an attributed development — reports suggest this occurred — rather than as a confirmed judicial finding, pending independent verification of the underlying case record.

Separately, a draft Artificial Intelligence Bill 2026, understood to be a Senate Bill, is reported to propose a risk-based regime for AI systems modelled in part on the EU AI Act, with stringent obligations envisaged for systems classified as high-risk. This Bill remains at proposed stage; it has not been confirmed enacted, and its EU-AI-Act-style risk-based structure should be read as a reported design feature of the draft rather than as an operative legal standard in Kenya at this time.

Read together, the reported biometric-deletion order and the draft AI Bill point toward an emerging, but not yet consolidated, algorithmic and biometric governance dimension within Kenya's data-protection landscape — one presently anchored more in judicial intervention on a specific lawful-basis question than in a dedicated statutory framework, pending the AI Bill's possible enactment.

Outlook

Whether the draft Artificial Intelligence Bill 2026 advances beyond proposed stage, and whether further confirmation emerges of the underlying judicial record behind the reported biometric-data deletion order, are the two developments to track for this module.

1 earlier distinct update(s)

Periodic update · new data 2026-09-14

Algorithmic, Biometric & Surveillance Governance

Reports suggest a draft Artificial Intelligence Bill 2026, understood to be a Senate Bill, proposes a risk-based AI governance regime for Kenya that would establish an Office of the Artificial Intelligence Commissioner and would require providers and deployers of high-risk AI systems to conduct data protection impact assessments under the existing Data Protection Act, 2019 before deploying such systems. This is an Uncertain-confidence finding, sourced from a single secondary reference, and the Bill had not been enacted as of this cycle's evidence.

The significance of this development, if it proceeds, is structural: it would be the first instance of Kenya's AI governance framework being explicitly wired into its existing data-protection impact-assessment machinery rather than creating a wholly separate compliance track, meaning high-risk AI deployment would trigger obligations under a statute AI developers may already be familiar with from other processing contexts. However, given the single-source basis for this finding and its Uncertain confidence tier, this should be read as an early-stage legislative proposal rather than an imminent compliance obligation.

Outlook

The Bill's progress through the Senate, and whether its DPIA-linkage provision survives into any enacted form, are the key developments to track. Given the current evidence base rests on a single secondary source, corroboration from an additional independent source or from the Bill's own text would materially strengthen confidence in this finding for the next cycle.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (3)

ConfirmedInternational Association of Privacy Professionals — The ODPC revoked Tools For Humanity's registration as a data processor and banned all Worldcoin activities in Kenya for one year, alleging the registration certificate was obtained through misrepresentation or material nondisclosure.observed 2026-08-05
ConfirmedInternational Association of Privacy Professionals — Failure to register or deliberately providing misleading information to the Data Commissioner's office is an offence punishable by a fine not exceeding KES 3 million or imprisonment not exceeding 10 years, or both, with courts additionally empowered to order forfeiture of related equipment.observed 2026-08-05
ProbableInternational Association of Privacy Professionals — Kenya's Miscellaneous Amendments Act of 2020 empowers security services to access personal data from any phone or computer, cited by civil-society analysts as an overly intrusive national-security exemption relative to the DPA framework.observed 2026-08-05

#

A children's-data provision exists in statute (Section 33) but lacks the granularity of GDPR Art 8 (no explicit age-of-consent threshold in the Act itself, no age-verification mechanics, no dependent-adult provisions located).

Primary frameworkData Protection Act, 2019 (Kenya), Section 33

Supervisory authorityOffice of the Data Protection Commissioner (ODPC)

Traffic-light rationale — AmberA children's-data provision exists in statute (Section 33) but lacks the granularity of GDPR Art 8 (no explicit age-of-consent threshold in the Act itself, no age-verification mechanics, no dependent-adult provisions located).

Sub-modules (5)

Age VerificationRed

No dedicated age-verification mechanism was identified in the Act or its regulations.

Absence provenance: unavailable. Searched: Kenya Data Protection Act age verification mechanism children.

Minor Profiling BansRed

No explicit ban on profiling of minors distinct from the general children's-data provision was identified.

Absence provenance: unavailable. Searched: Kenya minor profiling ban data protection.

Education SettingsRed

No education-setting-specific children's-data provision was identified beyond the general Section 33 requirements.

Absence provenance: unavailable. Searched: Kenya education setting children data protection specific rules.

Dependent AdultsRed

No dependent-adult (elderly/mentally-incapacitated) specific data protection provision was identified in available sources.

Absence provenance: unavailable. Searched: Kenya dependent adults vulnerable persons data protection provisions.

Category narrative58 words

Section 33 of the Act provides detailed requirements for processing children's data, though the Act itself does not define 'child'; Article 260 of the Constitution sets the age of adulthood at 18, which is generally read across as the operative threshold. No further education-setting-specific or dependent-adult-specific provisions, minor-profiling bans, or dedicated age-verification mechanisms were identified in available sources.

Sources and claims (1)

ConfirmedOneTrust DataGuidance — Section 33 of the Act provides detailed requirements for processing children's data, although the Act does not specifically define 'child'; Article 260 of the Kenyan Constitution sets the adulthood threshold at 18 years.observed 2026-08-05

#

Enforcement powers are legislated and actively used (multiple 2025-2026 fines/orders), but resourcing/independence concerns persist and collective-redress/private-right-of-action mechanisms remain undeveloped.

Primary frameworkData Protection Act, 2019 (Kenya); Data Protection (Compliance and Enforcement) Regulations, 2021

Supervisory authorityOffice of the Data Protection Commissioner (ODPC)

Traffic-light rationale — AmberEnforcement powers are legislated and actively used (multiple 2025-2026 fines/orders), but resourcing/independence concerns persist and collective-redress/private-right-of-action mechanisms remain undeveloped.

Sub-modules (6)

Regulator Powers And PenaltiesGreen

The DPC has powers to investigate (own-initiative or complaint-based), impose administrative fines, facilitate conciliation/mediation/negotiation, issue summons, and require explanations/information; maximum administrative penalty is KES 5 million or 1% of annual turnover (whichever lower), with additional daily fines of up to KES 10,000 per unrectified breach.

Claims (3):

The Data Commissioner has powers to conduct investigations on own initiative or on complaint, impose administrative fines for non-compliance, facilitate conciliation/mediation/negotiation, issue summons to witnesses, and require explanations/information/assistance from any person subject to the Act.
The maximum administrative penalty the DPC may impose in a penalty notice for an infringement of the Act is up to KES 5 million, or in the case of an undertaking, up to 1% of its annual turnover of the preceding financial year, whichever is lower.
Under the Compliance and Enforcement Regulations, the ODPC may issue a penalty notice including a daily fine of not more than KES 10,000 per identified breach until the breach is rectified; recipients of an enforcement notice may seek ODPC review or appeal to the High Court within 30 days.

Enforcement Activity IndexAmber

The ODPC issued multiple published enforcement decisions through 2025-2026, including fines against Platinum Credit Limited (KES 900,000, Jan 2025) and The Nairobi Hospital (KES 500,000, Dec 2025), alongside the Worldcoin/Tools For Humanity registration revocation and one-year activity ban.

Claims (3):

The ODPC found Platinum Credit Limited violated the Act by using personal data for commercial purposes without consent, ignoring the complainant's objection to marketing messages, and failing to erase the complainant's data, ordering KES 900,000 in compensation.
The ODPC ordered The Nairobi Hospital to delete unlawfully-used promotional advertisements containing a patient's covertly recorded image and to provide proof of deletion within 14 days, alongside a KES 500,000 fine, for violations of Sections 32(1) and 37 of the Act.
The ODPC revoked Tools For Humanity's registration as a data processor and banned all Worldcoin activities in Kenya for one year, alleging the registration certificate was obtained through misrepresentation or material nondisclosure.

Regulator Funding And CapacityAmber

Civil-society analysis (Access Now) found the ODPC lacks proper independence and recommended the Kenyan government provide adequate resources to ensure the office's effectiveness and functionality.

Claims (1):

Civil-society analysis found the ODPC lacks proper independence and recommended the Kenyan government provide adequate resources to ensure the office's effectiveness and functionality.

Collective Redress And Class ActionsRed

No dedicated collective-redress or class-action mechanism specific to data protection claims was identified in available sources.

Absence provenance: unavailable. Searched: Kenya Data Protection Act class action collective redress mechanism.

Private Right Of ActionAmber

Redress in practice runs through the ODPC's administrative complaint process (which can order compensation, as in the Platinum Credit and Nairobi Hospital decisions); a distinct standalone civil private right of action outside the ODPC/High-Court judicial-review route was not clearly identified in available sources.

Absence provenance: unavailable. Searched: Kenya Data Protection Act private right of action civil suit.

Claims (1):

The ODPC found Platinum Credit Limited violated the Act by using personal data for commercial purposes without consent, ignoring the complainant's objection to marketing messages, and failing to erase the complainant's data, ordering KES 900,000 in compensation.

Recent Developments 180DAmber

Within the last 180 days, the ODPC issued its Nairobi Hospital decision (16 December 2025, KES 500,000 for unauthorised promotional use of a patient recording) and continued to pursue the Worldcoin/Tools For Humanity matter, including registration revocation and a one-year activity ban following allegations of registration-certificate misrepresentation.

Claims (2):

The ODPC ordered The Nairobi Hospital to delete unlawfully-used promotional advertisements containing a patient's covertly recorded image and to provide proof of deletion within 14 days, alongside a KES 500,000 fine, for violations of Sections 32(1) and 37 of the Act.
The ODPC revoked Tools For Humanity's registration as a data processor and banned all Worldcoin activities in Kenya for one year, alleging the registration certificate was obtained through misrepresentation or material nondisclosure.

Key findings (1)

— source on file

Category narrative26 words

The ODPC has published 303 recorded decisions as of July 2026, with 2026 marking a documented shift to structured audits, compensation orders and court-enforced deletion mandates.

Periodic update · new data 2026-09-28

Enforcement & Redress

The ODPC determined 96 complaints in 2025, with penalties available of up to KES 5 million or 1% of annual turnover under section 63 of the Data Protection Act, 2019. This complaint-determination volume is the clearest available quantitative indicator of the ODPC's enforcement activity level heading into this cycle's reported shift toward more operationalised compliance activity.

In Regus Kenya Limited v Data Protection Commissioner [2025] eKLR, the High Court is understood to have upheld the ODPC's findings concerning unsolicited marketing continued after relationship termination, while reducing the penalty applied given the respondent's status as a first-time offender. This judicial outcome is significant on two fronts: it confirms judicial deference to the ODPC's substantive determination on unsolicited-marketing conduct, while also demonstrating that courts will moderate penalty severity for first-time offenders even where the underlying finding is upheld.

A Data Protection Amendment Bill is reported to propose expanding the ODPC's penalty toolkit, introducing graduated administrative penalties calibrated to the severity and duration of an infringement, above the current KES 5 million / 1% turnover cap. This proposal remains at an uncertain legislative stage; whether it has been tabled, is still in drafting, or has otherwise progressed could not be confirmed this cycle, and it should be read as a reported proposal rather than a settled change to the penalty regime.

Outlook

Whether the Data Protection Amendment Bill's proposed graduated-penalty structure advances, and whether the ODPC's 2026 complaint-determination volume continues at or above the 2025 pace of 96 determinations, are the concrete markers to track for this module going forward.

2 earlier distinct update(s)

Periodic update · new data 2026-09-21

Enforcement & Redress

Kenya's data-protection enforcement regime is reported to have undergone a material posture shift in 2026, moving from roughly five years of a largely reactive, registration- and education-focused approach into a structured phase featuring regulator-led compliance audits, compensation orders, and court-enforced data-deletion mandates. This is a probable-confidence characterisation resting on secondary legal commentary, but it is a coherent and internally consistent account across the specific enforcement mechanisms it describes.

Procedurally, the enforcement framework continues to rest on the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021, under which Regulation 14 requires the Data Commissioner, on conclusion of an investigation, to make a determination based on the findings of that investigation. This is a confirmed, primary-source-evidenced procedural requirement, directly sourced from ODPC's own published materials. Consistent with that procedural framework, ODPC maintains and publishes annual Determinations records spanning 2023, 2024, 2025 and 2026, a primary-source-confirmed pattern evidencing ongoing and continuous case-decision output over multiple years rather than a single enforcement episode.

The compliance-audit trigger taxonomy described this cycle — individual complaints, risk-based sectoral targeting on financial services and health-technology, random register-based selection, enforcement-notice follow-up, and inter-agency referral — sits within this broader enforcement architecture as the mechanism by which new audit activity is reported to be generated, feeding into the determination process that Regulation 14 requires.

Outlook

Watch for whether the volume or substance of ODPC's published annual Determinations shows a measurable increase or shift in character (for example, toward more financial-services or health-tech subject matter, or toward more compensation-order or deletion-mandate outcomes) in the 2026 records as they are finalised and published, which would provide primary-source corroboration of this cycle's reported enforcement-posture shift.

Periodic update · new data 2026-09-14

Enforcement & Redress

The ODPC is reported to have shifted its operational posture during 2026 from a largely reactive, registration-and-awareness-focused stance into structured compliance audits, compensation orders, and court-enforced data-deletion mandates, with a third-party tracker recording 303 decisions as of July 2026. This is a Probable-confidence finding and represents the single clearest enforcement-trajectory signal in this cycle's Kenya evidence: a regulator moving into an active phase after several years of a more dormant statutory presence.

This operational shift sits within a standing statutory penalty framework: the Data Commissioner may impose administrative fines of up to KES 5,000,000, or 1% of an organisation's annual turnover for the preceding financial year, whichever is lower, under section 63 of the Data Protection Act, 2019. This penalty ceiling has not changed this cycle, but its practical relevance has increased materially given the reported shift toward active audit and enforcement activity — a statutory ceiling only matters once a regulator is actually applying it, and the evidence this cycle suggests ODPC is doing so with increasing frequency.

Outlook

The key question for future cycles is whether the reported 303-decision volume translates into a sustained pattern of formal administrative fines under the section 63 ceiling, as opposed to compensation orders and deletion mandates that may not always involve a monetary penalty. Sector-level audit-selection patterns, particularly in financial services, telecoms, health-tech, digital platforms and HR outsourcing, are also worth tracking as indicators of where enforcement pressure will concentrate next.

1 further periodic run re-emitted the standing brief unchanged and is not shown.

Sources and claims (4)

ConfirmedInternational Association of Privacy Professionals — The Data Commissioner has powers to conduct investigations on own initiative or on complaint, impose administrative fines for non-compliance, facilitate conciliation/mediation/negotiation, issue summons to witnesses, and require explanations/information/assistance from any person subject to the Act.observed 2026-08-05
ConfirmedInternational Association of Privacy Professionals — The maximum administrative penalty the DPC may impose in a penalty notice for an infringement of the Act is up to KES 5 million, or in the case of an undertaking, up to 1% of its annual turnover of the preceding financial year, whichever is lower.observed 2026-08-05
ConfirmedOneTrust DataGuidance — Under the Compliance and Enforcement Regulations, the ODPC may issue a penalty notice including a daily fine of not more than KES 10,000 per identified breach until the breach is rectified; recipients of an enforcement notice may seek ODPC review or appeal to the High Court within 30 days.observed 2026-08-05
ProbableInternational Association of Privacy Professionals — Civil-society analysis found the ODPC lacks proper independence and recommended the Kenyan government provide adequate resources to ensure the office's effectiveness and functionality.observed 2026-08-05

No categories match.

Filters combine as OR inside a group and AND across groups.

Publication gate

No failing checks.

`schema_valid`	pass
`min_t1_per_instrument_met`	n/a — no subject in this jurisdiction
`min_quoted_text_present`	waived — floor 0%
`translation_provenance_recorded`	n/a — no subject in this jurisdiction
`egress_verified`	pass
`source_tier_integrity_ok`	pass
`jurisdiction_source_floor_met`	pass
`tier_a_b_national_primary_pct`	8.33
`aggregator_only_jurisdiction_count`	0
`manual_override`

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Kenya
Field	Value
`trust.lawyer_review.status`	never_reviewed
`trust.lawyer_review.reviewer`	no reviewer on record
`trust.content_source`	ai_generated

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-02. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 46 claim(s) (46 category placement(s)), 26 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map

GDPR article to category mapping
Article	Category	Sub-module
`Art. 5`	Controller/Processor Duties	accountability and dpia
`Art. 6`	Lawful Processing & Special Data	lawful bases
`Art. 7`	Lawful Processing & Special Data	consent thresholds
`Art. 9`	Lawful Processing & Special Data	special categories
`Art. 13`	Data Subject Rights	access right
`Art. 14`	Data Subject Rights	access right
`Art. 15`	Data Subject Rights	access right
`Art. 16`	Data Subject Rights	rectification and erasure
`Art. 17`	Data Subject Rights	rectification and erasure
`Art. 18`	Data Subject Rights	restriction and objection
`Art. 19`	Data Subject Rights	rectification and erasure
`Art. 20`	Data Subject Rights	data portability
`Art. 21`	Data Subject Rights	restriction and objection
`Art. 22`	Algorithmic, Biometric & Surveillance Governance	automated decision making transparency
`Art. 25`	Controller/Processor Duties	accountability and dpia
`Art. 28`	Controller/Processor Duties	joint controller arrangements
`Art. 30`	Controller/Processor Duties	ropa requirements
`Art. 32`	Controller/Processor Duties	security measures
`Art. 33`	Controller/Processor Duties	breach notification
`Art. 34`	Controller/Processor Duties	breach notification
`Art. 35`	Controller/Processor Duties	accountability and dpia
`Art. 37`	Controller/Processor Duties	dpo requirements
`Art. 38`	Controller/Processor Duties	dpo requirements
`Art. 39`	Controller/Processor Duties	dpo requirements
`Art. 44`	Cross-Border & Adequacy	transfer mechanisms
`Art. 45`	Cross-Border & Adequacy	adequacy received
`Art. 46`	Cross-Border & Adequacy	adequacy granted
`Art. 47`	Cross-Border & Adequacy	sccs and bcrs
`Art. 48`	Cross-Border & Adequacy	sccs and bcrs
`Art. 49`	Cross-Border & Adequacy	transfer impact assessment
`Art. 77`	Enforcement & Redress	regulator powers and penalties
`Art. 78`	Enforcement & Redress	private right of action
`Art. 79`	Enforcement & Redress	private right of action
`Art. 80`	Enforcement & Redress	collective redress and class actions
`Art. 81`	Enforcement & Redress	collective redress and class actions
`Art. 82`	Enforcement & Redress	regulator powers and penalties
`Art. 83`	Enforcement & Redress	regulator powers and penalties
`Art. 84`	Enforcement & Redress	regulator powers and penalties

Self-audit

All 10 modules populated. regulator_and_framework, controller_processor_duties, cross_border_and_adequacy, and enforcement_and_redress modules have strong T2/T3 secondary-source coverage (DataGuidance/IAPP reporting on statute text, regulations, and ODPC enforcement decisions) supplemented by one T1 anchor (ODPC official site). lawful_processing_and_special_data and data_subject_rights rely primarily on T2 comparative-law analysis (DataGuidance GDPR-v-Kenya guide) rather than direct primary-text citation of the Act, since the statute's full text was not directly retrievable via search in this run. adtech_and_commercial_privacy and algorithmic_biometric_and_surveillance_governance are populated where direct-marketing/DPIA/biometric provisions exist (T2/T3) but carry multiple absent_field_provenance sub-modules (cookies, dark patterns, opt-out signals, AI risk assessments, ADM transparency) reflecting genuine regime gaps rather than research gaps. children_and_vulnerable_groups relies on a single Section 33 reference (T2) with most sub-modules marked absent. sectoral_watch has T2 coverage for telecoms/financial/health but explicit gaps for education/insurance.

Unresolved questions (5):

What are the exact numeric thresholds (industry type, data volume) the ODPC applies under the Registration Regulations beyond the KES 5 million turnover / 10-employee exemption?
Has the ODPC published any approved SCC-equivalent template or BCR-style mechanism since 2021, and if so, under what regulation?
What is the current operational status and outcome of the Worldcoin/Tools For Humanity High Court litigation and the one-year ODPC-imposed activity ban (start/end dates)?
Is there a codified statutory SAR/rectification/erasure response deadline for controllers distinct from the ODPC's own 90-day complaint-resolution timeline?
Does Kenya's DPA or its regulations contain any explicit data-retention period schedule, or is retention governed solely by the general storage-limitation principle?

Escalate to primary-source review: yes

Kenya

Jurisdiction brief

Latest update · 28 September 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Standing brief · as of 25 August 2026

Lead Signal

Other Developments

Cross-Monitor Connections

Outlook

Latest update · 28 September 2026

Regulatory Status

Outlook

Standing brief · as of 25 August 2026

Regulatory Status

Outlook

regulator_and_frameworkRegulator & Framework5 sub-modules6 claimsAmber▾#

Sub-modules (5)

Regulator And AuthorityAmber

Act And InstrumentsGreen

Material ScopeGreen

Territorial ScopeGreen

Regulator Registration And FilingAmber

Regulator & Framework

Outlook

lawful_processing_and_special_dataLawful Processing & Special Data4 sub-modules5 claimsGreen▾#

Sub-modules (4)

Lawful BasesGreen

Consent ThresholdsAmber

Special CategoriesGreen

Pseudonymisation And AnonymisationGreen

data_subject_rightsData Subject Rights5 sub-modules4 claimsAmber▾#

Sub-modules (5)

Access RightAmber

Rectification And ErasureAmber

Restriction And ObjectionAmber

Data PortabilityRed

Deadlines And Response WindowsAmber

Data Subject Rights

Outlook

Data Subject Rights

Outlook

controller_processor_dutiesController/Processor Duties7 sub-modules10 claimsAmber▾#

Sub-modules (7)

Accountability And DpiaGreen

Dpo RequirementsAmber

Ropa RequirementsAmber

Joint Controller ArrangementsRed

Security MeasuresGreen

Breach NotificationGreen

Retention And DisposalRed

Controller/Processor Duties

Outlook

Controller/Processor Duties

Outlook

cross_border_and_adequacyCross-Border & Adequacy6 sub-modules7 claimsAmber▾#

Sub-modules (6)

Transfer MechanismsAmber

Adequacy ReceivedRed

Adequacy GrantedRed

Sccs And BcrsRed

Transfer Impact AssessmentAmber

Data LocalisationAmber

Cross-Border & Adequacy

Outlook

sectoral_watchSectoral Watch7 sub-modules5 claimsAmber▾#

Sub-modules (7)

Financial Sector OverlayAmber

Health Sector OverlayAmber

Telecoms And EprivacyGreen

Employment DataAmber

Credit And ScoringAmber

EducationRed

InsuranceRed

Sectoral Watch

Outlook

adtech_and_commercial_privacyAdTech & Commercial Privacy6 sub-modules1 claimAmber▾#

Sub-modules (6)

#

#

#

#

#

#

#

#

#

#