The Kenya Data Protection Act has practical implications for any organisation that collects, stores or processes personal data. This guide covers the core obligations in plain, actionable language.
The Kenya Data Protection Act 2019 applies to any data controller or data processor that processes personal data in or from Kenya — regardless of size or sector. If you hold names, contact details, financial information or any other personal data, the obligations apply.
Most organisations need to demonstrate the following: