The Kenya Data Protection Act, for companies without a legal team
A practical checklist of what the Act actually requires of a small business holding customer data — and the handful of things worth doing first.
The Data Protection Act 2019 applies to you if you hold personal data about Kenyan residents, which for practically any business with customers means it applies to you. This is not legal advice — get that from someone qualified. It is the engineering-side checklist we work through with clients, in the order we work through it.
Start by finding out what you hold
You cannot protect data you have not inventoried, and almost every company we audit is holding more than it thinks. National ID numbers collected during onboarding and never deleted. Phone numbers in three systems. A spreadsheet of customer records on someone’s personal Drive from a 2023 campaign.
Write down, for every system: what personal data is in it, why you collected it, who can reach it, and how long you keep it. This document is the foundation for everything else, and producing it usually surfaces two or three things you should simply delete.
The obligations that actually bite
Registration. Depending on your size and what you process, you may need to register as a data controller or processor with the Office of the Data Protection Commissioner. Check the current thresholds — they have been revised.
A lawful basis for processing. Consent is one basis, not the only one, and often not the strongest. Contractual necessity covers most of what you do to serve a customer. Where you do rely on consent, it has to be freely given and specific — a pre-ticked box in a signup flow is not consent.
Data subject rights. People can ask what you hold about them, ask you to correct it, and ask you to delete it. You need to be able to answer within the statutory window. In practice this means knowing where a given person’s records live across every system — which is exactly what the inventory gives you.
Breach notification. If personal data is compromised, you have 72 hours to notify the Commissioner. Decide now who makes that call, because you will not want to be working out the org chart during an incident.
Cross-border transfers. Moving personal data outside Kenya has conditions attached. Worth noting if your warehouse region is in Europe or the US, which it probably is — this is a real reason to think about where you provision.
What to do first, if you only do three things
- Write the inventory. Everything else depends on it, and it costs you a day.
- Fix access. Most small companies have far too many people with production database access and no audit trail. Least privilege, logged, reviewed quarterly.
- Set retention rules and actually enforce them. Data you deleted on schedule is data that cannot leak. This is the cheapest risk reduction available to you.
The engineering-side habits that make compliance cheap
Compliance stays affordable when it is a property of your architecture rather than a quarterly scramble. Keep personal data in as few tables as you can. Separate identity from behaviour, so analytics can run on data that has no names in it. Pseudonymise in your analytical models by default — most dashboards do not need to know who someone is. Put retention into the pipeline as a scheduled deletion job, not into a policy document nobody reads.
Do those four things and most of the Act becomes paperwork describing what you already do, which is the position you want to be in.