IS KENYA’S DATA PROTECTION REGIME REALLY WORKING?

Across Kenya today, personal data moves faster than the public service vehicles on our roads. From mobile lending apps and supermarket loyalty programmes to school portals and nightlife marketing, organizations collect names, ID numbers, phone contacts, photos and even biometrics as part of everyday transactions.

Seven years after the Data Protection Act, 2019 came into force, one question WAREN Law Advocates LLP wishes to answer: is the regime actually working, or is privacy still more promise than practice?

 

WHAT DOES KENYA’S DATA PROTECTION FRAMEWORK LOOK LIKE?

Kenya’s modern data protection regime is anchored in Article 31 of the Constitution of Kenya,2010 and the Data Protection Act, 2019 (Cap. 411C). The Act is supported by four key sets of Regulations including: Civil Registration, General Regulations, Complaints Handling and Enforcement, and Registration of Data Controllers and Processors.

Together, our Constitution and these pieces of legislation:

1. Establish the Office of the Data Protection Commissioner (ODPC) to enforce the Act and handle complaints.
2. Require registration of data controllers and processors, subject to limited exemptions for very small entities.
3. Set out principles of lawful processing (transparency, purpose limitation, data minimization, accuracy and security).
4. Create enforceable rights for data subjects, including the right to be informed, to access, to object, to correction and to deletion.

On paper, therefore, Kenya has a comprehensive framework that mirrors many global best practices. The real test lies in implementation.

 

ENFORCEMENT IN PRACTICE: WHEN THE ODPC BITES

Over the past few years, the ODPC has moved from awareness-raising to active enforcement, using its powers to investigate complaints, conduct audits and impose administrative fines. Several decisions illustrate that mishandling personal data can now carry real consequences:

• Mulla Pride Ltd (Digital Credit Provider)

The ODPC fined the operator of KeCredit and Faircash apps Kes. 2,975,000 for using contact information obtained from third parties, rather than data subjects, to call and threaten alleged debtors. The Commissioner found that the company processed personal data without consent and without properly informing the data subjects of the purpose of collection, in breach of the Act and Regulations.

• Casa Vera Lounge

A Nairobi entertainment venue was fined KES 1,850,000 for posting a patron’s image on social media without consent. The ODPC held that using a person’s photograph for marketing without their permission infringed their right to privacy and violated the principles of lawful and fair processing.

• Roma School

The institution was fined KES 4,550,000 for posting photographs of minors on social media without obtaining parental consent. This decision reinforced that children’s data attracts heightened protection and that schools must be particularly careful in how they use images and other personal information.

• John Onkangi v National Bank of Kenya Ltd & Keysian Auctioneers (ODPC Complaint No. 1766 of 2023)

The ODPC found that the bank unlawfully shared the complainant’s personal information with a third party without authorization. National Bank argued that an employee had acted outside authority, but the ODPC held the bank vicariously liable because the disclosure was closely connected to the bank’s instructions. Compensation was ordered in favor of the complainant.

 

These decisions show that enforcement is not theoretical: organisations that treat personal data casually now face financial penalties, reputational damage and binding compliance directions.

 

WHAT THIS MEANS FOR ORGANISATIONS AND BUSINESSES

For organizations in Kenya, whether law firms, hospitals, schools, fintechs, Saccos or SMEs, the message is clear: data protection is now a compliance and governance issue.

In practical terms, this means:

• Registration and mapping – Determining whether you are a data controller, processor or both, and registering with the ODPC where required. Organizations should map what data they collect, from whom, for what purpose and where it is stored.
• Policies and safeguards – Implementing clear data privacy policies, data protection policies, retention schedules and security measures (both technical and organizational) to guard against loss, unauthorized access or misuse.
• Respecting data subject rights – Putting in place procedures to handle access, correction, objection and deletion requests within reasonable timelines and in line with Section 26 of the Act.
• Training and accountability – Ensuring that staff understand the basics of data protection and that breaches by employees are treated as organizational risks, not just individual mistakes.
• Vendor and third-party management – Reviewing contracts with processors, service providers and partners to ensure they include data protection obligations and audit rights.

Ultimately, building a culture of compliance will build trust with clients and the public.

 

WHAT THIS MEANS FOR INDIVIDUALS: TAKE CONTROL OF YOUR DATA

For individuals, the emerging enforcement landscape means that privacy is no longer an abstract constitutional promise. It is a day-to-day discipline backed by a regulator that can act on complaints.

Key takeaways for data subjects include:

1. You have rights – You can ask why your data is being collected, who it will be shared with and how long it will be kept. You can request access to your data, ask for corrections where it is inaccurate and seek deletion where it is misleading, unnecessary or unlawfully obtained.
2. You are not powerless – If an organization misuses your personal information by posting your photos without consent, harassing your contacts about a debt or sharing your financial records with third parties, you can lodge a complaint with the ODPC. The Commissioner can investigate and order remedies, including compensation.
3. Everyday choices matter – Being cautious about what information you hand over, reading consent forms, checking app permissions and adjusting privacy settings are part of exercising your rights, not paranoia.
4. Legal support is available – As Kenyan jurisprudence on data protection grows, lawyers and other professionals are increasingly equipped to advise on compliance, respond to investigations and litigate complex privacy disputes.

For the ordinary Kenyan, “take control of your data” means moving from passive acceptance to informed decision-making whenever personal information is requested.

 

CONCLUSION

Kenya’s data protection regime is still evolving, but it is undeniably gaining teeth. The ODPC’s enforcement track record, court decisions endorsing accountability and ongoing regulatory activity suggest that organizations can no longer afford to treat personal data as a free resource.

 

For businesses and institutions, investing in compliance such as policies, training, secure systems and respectful data practices is now a core part of risk management and corporate governance. For individuals, the law provides a toolkit to question, challenge and seek remedies when their personal information is mishandled.

As Waren Law Advocates LLP deepens its focus on data protection and related intellectual property issues, our constant this Data Privacy Week is simple: TAKE CONTROL OF YOUR DATA because in Kenya’s digital era, your information is not just a record, it is an asset that deserves protection.