Kenya

The Data Protection Act, No. 24 of 2019 (consolidated as Cap. 411C), section 4, applies in two situations. It applies if you are set up or normally living in Kenya and you handle personal data in Kenya. It also applies if you are not set up or normally living in Kenya, but you handle personal data about people located in Kenya. The registration thresholds sit in the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, regulation 13(2) and (4). The twelve override categories are in the Third Schedule. A registration certificate lasts twenty-four months. Fees run from 4,000 shillings for a micro or small business to 40,000 shillings for a large one, with lower renewal fees. Unlike the European Union, the Kenyan regulations do not make a foreign company appoint a local representative. That looks like a real gap, but we cannot confirm it either way.

The general answer is conditional, not open. There is always something to put in place before data leaves. The location rules come from regulation 26 of the Data Protection (General) Regulations, 2021, made under section 50 of the Act. Regulation 26(1) gives you a choice. You either handle the data 'through a server and data centre located in Kenya'. Or you 'store at least one serving copy of the concerned personal data in a data centre located in Kenya'. So these are mirror rules, not full bans. A foreign copy stays lawful. Sector by sector, verified today. Government and public administration. Mirror rule. It covers civil registration and legal identity, elections, and public finance administration. Education. Mirror rule, limited to early childhood and basic education. Health. Mirror rule, limited to primary and secondary health care. The regulator's own health guidance goes further. It says it expects health data to be stored and handled in Kenya, unless the patient explicitly consents to a transfer. Telecoms and internet. A mirror rule in reality. The regulator's guidance for the communications sector says most service providers are protected computer systems. That is under the Computer Misuse and Cybercrimes Act. So they must follow regulation 26. Banking and payments. We found no rule on the Central Bank's own site requiring data to stay in Kenya, checked 18 August 2026. The Central Bank's prudential guidelines list an outsourcing guideline, but we could not open its text. Insurance, securities, gambling, mapping and defence. We found no rule on an official government website, checked 18 August 2026. Treat these as unresearched rather than settled. The telecoms subscriber rules were re-made in 2025. They say nothing at all about where data is stored or how long it is kept.

The rules on sending data outside Kenya sit in the Data Protection (General) Regulations, 2021. Regulation 40 sets the four bases. Regulation 41 says appropriate safeguards means a binding legal document that ties the recipient to protection essentially equal to the Act and these Regulations. It also makes you write the transfer down, and produce that paperwork to the Commissioner on request. Regulation 42 treats safeguards as good enough in three cases. The destination country has ratified the African Union Convention on Cyber Security and Personal Data Protection. Or it has a reciprocal data protection arrangement with Kenya. Or binding corporate rules apply. Regulation 43 sets out what binding corporate rules must contain. Regulation 44 lets the Data Commissioner decide that a country is safe enough, and publish that on the office's website. We found no published list, so treat the list as empty. Regulation 46 is the consent route. It also says sensitive personal data may only be sent abroad with the consent of the person it is about. Regulation 47 controls passing data on again. Regulation 48 allows cross-border agreements that name permitted destination countries and give the sender audit access. One limit in our own vocabulary. The main Kenyan route is a contract you assess yourself, with no government template. That does not map cleanly onto any single code in our list, so the list of mechanisms below understates the route most people actually use.

We rate enforcement active rather than aggressive. The volume and the naming are real, and the office does refer cases for prosecution. But the maximum fine under section 63 is the lower of five million shillings or one per cent of annual turnover. That is around 38,000 United States dollars. It is small by international standards, and it does little to deter a large firm. Sector regulators exist and work: the Communications Authority of Kenya, the Central Bank of Kenya, and the National Computer and Cybercrimes Co-ordination Committee. We found no enforcement by any of them, on their own sites, of the rules about keeping data in Kenya. The Data Commissioner at the time of writing is Immaculate Kassait. We could not confirm her appointment date or remaining term from the office's own pages.

Section 39 of the Data Protection Act says personal data must be kept 'only as long as may be reasonably necessary'. That is subject to a legal requirement, a lawful purpose, or the person's authorisation. Regulation 19 of the General Regulations, 2021 repeats this. It adds a duty to 'erase, delete anonymise or pseudonymise personal data upon the lapse of the purpose'. The public sector guidance and the health guidance both require a written retention schedule, reviewed from time to time. The health guidance gives one concrete example. A provider keeps the records of dead or non-returning patients for seven years. It then destroys them securely, or removes the names. That is an example of a period you could defend, not a legal minimum. Where a real legal duty to keep data clashes with the duty to delete, section 39 favours keeping it. Keeping data because the law requires it is an express exception.

Section 43 of the Data Protection Act. The forty-eight hour clock from supplier to customer is the operational trap. It is shorter than the seventy-two hour clock to the regulator, and it starts when the supplier itself learns of the breach. So a global supplier's standard 'notify without undue delay' contract wording is not enough for Kenya. You must tell the affected people where the breach is likely to create a real risk to their rights and freedoms. The National Computer and Cybercrimes Co-ordination Committee runs a reporting form under the Computer Misuse and Cybercrimes Act, 2018. We found no published deadline in hours on its site. That is a deadline we could not find, not a deadline that does not exist.

(1) Children. The Act defines a child as under eighteen. The General Regulations, 2021, regulation 13 bans profiling a child for direct marketing. The November 2025 children's guidance note requires 'appropriate mechanisms for age verification and consent'. There is no lower digital consent age as in Europe. (2) Criminal exposure. Section 73 sets a fine of up to three million shillings (about 23,000 United States dollars) or imprisonment of up to ten years. The April 2026 microfinance decision shows the office actually recommending prosecution of directors for obstruction under section 61(b). The cap on fines from the regulator, in section 63, is the lower of five million shillings or one per cent of annual turnover. Because it is the lower of the two, the percentage limits large firms rather than exposing them. (3) Registration. Regulation 9 of the Registration Regulations, 2021 gives a twenty-four month certificate. Regulation 13 sets the exemption. The Third Schedule lists twelve activities where the exemption does not apply. They include gambling, financial services, telecommunications, direct marketing, health administration, education, hospitality, property management, transport and genetic data. (4) Sensitive data. Regulation 46 lets sensitive personal data go abroad only with the consent of the person it is about. Safeguards alone will not carry health, biometric or similar data out of Kenya. (5) The protected systems hook. The communications guidance says most service providers are protected computer systems under the Computer Misuse and Cybercrimes Act, and so fall inside regulation 26. The government makes that designation, not you. So the reach of the rule can change without you doing anything.

Powers the government already holds, in order of how fast they could hurt. (1) Section 50 of the Act lets the Cabinet Secretary name further categories of data that must stay on Kenyan servers. The Data Commissioner has to recommend it first. The grounds are the strategic interests of the state, or protecting revenue. The revenue ground has never been used. If it were, it would reach ordinary commercial data. (2) The 'protected computer system' designation under the Computer Misuse and Cybercrimes Act, 2018 automatically pulls whatever it touches into regulation 26. The privacy regulator already treats most communications providers as caught. Extending it to other operators needs no change to the data protection rules at all. (3) Regulation 44 lets the Data Commissioner declare countries safe enough and publish the list. We found no published list. That cuts both ways. Nothing is approved, and nothing is blocked. But the office could reshape where you may send data by publishing a narrow list. Also unresolved: the term of office of the current Data Commissioner. We could not confirm it, and it is a natural point where things could change. We found no pending data protection bill on Parliament's own bills listing, checked 18 August 2026.