KenyaData Protection Act, 2019
Data Protection Act, 2019 (No. 24 of 2019), ss. 1-30 (establishment, principles and obligations)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, User location
- Audit expectation
- periodic
- Who audits it
- Regulator
What it requires
- Process personal data lawfully, fairly and transparently, only for an explicit and legitimate purpose, and collect no more than is necessary for that purpose.NIST Privacy FrameworkGV.PO-P1
- Register with the Office of the Data Protection Commissioner if your volume or category of processing meets the prescribed threshold.NIST Privacy FrameworkGV.PO-P5
- Obtain consent from a child's parent or guardian, verified through an age-verification mechanism, before processing that child's personal data.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: Office of the Data Protection Commissioner of Kenya (guidance, recorded ); Republic v Tools for Humanity Corporation (US) & 9 others; Katiba Institute & 4 others (Ex parte Applicants) (Judicial Review Application E119 of 2023) [2025] KEHC 5629 (KLR), High Court of Kenya (Judicial Review), judgment of (recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/5629/eng@2025-05-05
- Guidance link
- https://www.odpc.go.ke/wp-content/uploads/2024/02/ODPC-Guidance-Note-on-Registration-of-Data-Controllers-and-Data-Processors.pdf
- Case citation
- Republic v Tools for Humanity Corporation (US) & 9 others; Katiba Institute & 4 others (Ex parte Applicants) (Judicial Review Application E119 of 2023) [2025] KEHC 5629 (KLR), High Court of Kenya (Judicial Review), judgment of
- Guidance body
- Office of the Data Protection Commissioner of Kenya
- Open questions
- Must a private-sector entity meet both limbs of the registration test in the Registration guidance note, which describes entities that must register as those with "an annual Turnover or Revenue of Kshs. 5 million and above or more than 10 employees" while stating that "To graduate to the next tier an Entity must meet both requirements"?
What it makes you log
Logging duty
Sections 1 to 30 set the principles, the registration duty and the Commissioner's audit power. Section 19 has an applicant file particulars and notify the Commissioner of any change, and section 21 has the Commissioner keep the register, so the only record those sections describe is the regulator's own. None of them requires a controller or processor to keep a log or a record of its processing. Section 32(1), which puts the burden of proving consent on the controller, lies outside the sections this row cites.
- Kind
- None
- As of
What this law does
The Data Protection Act, 2019 establishes the Office of the Data Protection Commissioner and requires every data controller or processor to process personal data lawfully, fairly and transparently, and only for an explicit and legitimate purpose that is proportionate to what is collected.
A data controller or processor must register with the Data Commissioner where the prescribed threshold is met, and must not process a child's personal data unless a parent or guardian has consented and the controller has implemented a mechanism to verify the child's age. A data subject's consent may be withdrawn at any time, without affecting the lawfulness of processing already carried out before the withdrawal.
When LexLint raises it
When your app profile says your app serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .