CevroKenya: Kenya DPA and what it requires
Data Protection Act 2019: an established law with an active enforcement record. Overseen by Office of the Data Protection Commissioner (ODPC).
Key requirements at a glance
| Registration with the regulator | Required |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | Within 72 hours |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Active enforcement, with fines issued for non-compliance.
What to know in practice
Registration and DPIA obligations apply above defined processing thresholds.
The security duty
Under s.41: Data protection by design or default: appropriate technical and organisational measures that build the data protection principles and safeguards into processing. Source: published text, checked 2026-10.
How Cevro helps
- Maps Kenya DPA to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Counts your automated technical checks as evidence toward the security duty in s.41.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Kenya?
Office of the Data Protection Commissioner (ODPC) oversees Data Protection Act 2019.
Is breach notification mandatory under Kenya DPA?
The law sets a 72-hour window for notifying the regulator of a personal data breach, so you need detection and an incident process that can meet it.
Does Kenya restrict cross-border data transfers?
Yes. Moving personal data out of Kenya is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Kenya DPA?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in Kenya?
Active enforcement, with fines issued for non-compliance.