KenyaData Protection Act, 2019, transfer of personal data outside Kenya
Data Protection Act, 2019 (No. 24 of 2019), Part VI (ss. 48-54)
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Give the Data Commissioner proof of appropriate safeguards, or otherwise satisfy a condition under section 48, before transferring personal data outside Kenya.NIST Privacy FrameworkCT.PO-P2
- Check whether the Cabinet Secretary has designated your category of processing for mandatory handling on a server or data centre located in Kenya.NIST Privacy FrameworkID.IM-P7
These lines are LexLint's reading of the law's text. Also read by: Office of the Data Protection Commissioner of Kenya (guidance, recorded ); Republic v Tools for Humanity Corporation (US) & 9 others; Katiba Institute & 4 others (Ex parte Applicants) (Judicial Review Application E119 of 2023) [2025] KEHC 5629 (KLR), High Court of Kenya (Judicial Review), judgment of (recorded ).
In the frameworks
- NIST Privacy Framework
- ID.IM-P7The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/5629/eng@2025-05-05
- Guidance link
- https://www.odpc.go.ke/wp-content/uploads/2026/09/ODPC-–-Guidance-Notes-for-Cross-border-Data-Transfers.pdf
- Case citation
- Republic v Tools for Humanity Corporation (US) & 9 others; Katiba Institute & 4 others (Ex parte Applicants) (Judicial Review Application E119 of 2023) [2025] KEHC 5629 (KLR), High Court of Kenya (Judicial Review), judgment of
- Guidance body
- Office of the Data Protection Commissioner of Kenya
- Open questions
- Does section 48 of the Data Protection Act, 2019 require the Data Commissioner to have found the receiving country adequate before a transfer, as Republic v Tools for Humanity [2025] KEHC 5629 describes it, or may a controller transfer on proof of the "appropriate safeguards" that section 48(a) names?
What it makes you log
Who may demand the log
Regulator
Logging duty
Part VI (sections 48 to 54) makes a transfer out of Kenya conditional on the controller or processor having given the Data Commissioner proof of appropriate safeguards (section 48), and lets the Commissioner ask the transferor to demonstrate the effectiveness of those safeguards (section 49(2)). That is a power to demand a demonstration and no log or record is named. Section 53(2) asks for safeguards against research records being used for other purposes, which is a use limit and not a logging duty.
- Kind
- None
- As of
What this law does
A data controller or processor may transfer personal data outside Kenya only where it has given the Data Commissioner proof of appropriate safeguards, or another condition such as the data subject's consent applies, and the Commissioner may prohibit, suspend or condition a transfer to protect data subjects' rights.
The Cabinet Secretary may prescribe that certain processing, on grounds of strategic state interest or protection of revenue, be carried out only through a server or data centre located in Kenya.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .