Kenya

Data Protection Act, No. 24 of 2019 (consolidated as Cap. 411C), section 4, applies the Act both to controllers and processors established or ordinarily resident in Kenya and processing personal data in Kenya, and to those 'not established or ordinarily resident in Kenya, but processing personal data of data subjects located in Kenya'. Registration thresholds sit in the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, regulation 13(2) and (4), with the twelve override categories in the Third Schedule. A registration certificate lasts twenty-four months; fees run from 4,000 shillings for a micro or small entity to 40,000 shillings for a large one, with lower renewal fees. Unlike the European Union, the Kenyan regulations contain no local-representative duty for foreign controllers — a genuine gap rather than an oversight we can confirm either way.

Headline rating is sectoral, but note that the general baseline is itself conditional, not open — there is always something to put in place before data leaves. The sector walls come from regulation 26 of the Data Protection (General) Regulations, 2021, made under section 50 of the Act. Regulation 26(1) offers a choice: process 'through a server and data centre located in Kenya' OR 'store at least one serving copy of the concerned personal data in a data centre located in Kenya'. That makes these mirror rules, not full bans — a foreign copy stays lawful. Sector-by-sector, verified today: GOVERNMENT AND PUBLIC ADMINISTRATION — mirror (civil registration and legal identity, elections, public finance administration). EDUCATION — mirror, limited to early childhood and basic education. HEALTH — mirror, limited to primary and secondary health care provision; the regulator's own health guidance goes further and states the expectation that health data is stored and processed in Kenya unless the patient explicitly consents to a transfer. TELECOMS AND INTERNET — mirror in practice: the regulator's communications-sector guidance states that most service providers are protected computer systems under the Computer Misuse and Cybercrimes Act and must therefore comply with regulation 26. BANKING AND PAYMENTS — no localisation rule found on the Central Bank's own site, checked 18 August 2026; the Central Bank's prudential guidelines index an outsourcing guideline but we could not open its text. INSURANCE, SECURITIES, GAMBLING, MAPPING AND DEFENCE — no rule found on an official domain, checked 18 August 2026; treat as unresearched rather than clear. Sector telecoms subscriber rules were re-made in 2025 and, notably, contain no storage-location or retention duty at all.

Data Protection (General) Regulations, 2021, Part on transfer outside Kenya. Regulation 40 sets the four bases. Regulation 41 defines appropriate safeguards as 'a legal instrument containing appropriate safeguards for the protection of personal data binding the intended recipient that is essentially equivalent to the protection under the Act and these Regulations', and requires the transfer to be documented and the documentation produced to the Commissioner on request. Regulation 42 deems safeguards adequate where the destination has ratified the African Union Convention on Cyber Security and Personal Data Protection, has a reciprocal data protection arrangement with Kenya, or where binding corporate rules apply. Regulation 43 sets out what binding corporate rules must contain. Regulation 44 allows the Data Commissioner to make and publish adequacy decisions on the office's website; we found no published list, so treat the list as empty. Regulation 46 is the consent route and also states that sensitive personal data may only be transferred with the data subject's consent. Regulation 47 controls onward transfers, and regulation 48 allows cross-border agreements that name permitted destination countries and give the sender audit access. Note a vocabulary limitation: the dominant Kenyan route is a self-assessed contractual safeguard with no government template, which does not map cleanly onto any single transfer-mechanism code in this framework, so the mechanism list below understates the practical route.

Rated active rather than aggressive: the volume and the naming are real, and the office reaches into criminal referral, but the administrative fine ceiling under section 63 is the lower of five million shillings or one per cent of annual turnover — around 38,000 US dollars — which is small by international standards and blunts the deterrent for large firms. Sector regulators exist and function (the Communications Authority of Kenya, the Central Bank of Kenya, the National Computer and Cybercrimes Co-ordination Committee) but we found no data-localisation enforcement by any of them on their own sites during this run. The Data Commissioner at the time of writing is Immaculate Kassait; we could not verify the appointment date or remaining term from the office's own pages.

Data Protection Act section 39 requires that personal data be retained 'only as long as may be reasonably necessary', subject to a legal requirement, a lawful purpose, or the data subject's authorisation. Regulation 19 of the General Regulations, 2021 repeats this and adds the duty to 'erase, delete anonymise or pseudonymise personal data upon the lapse of the purpose'. The public sector and health guidance notes both require a documented retention schedule reviewed periodically. One concrete illustration appears in the health guidance: a provider retaining the records of deceased or non-returning patients for seven years before secure destruction or anonymisation — that is an example of a defensible period, not a legal minimum. Where a genuine legal keeping duty conflicts with the delete-when-done rule, section 39 resolves it in favour of the keeping duty, because retention required by law is an express exception.

Data Protection Act section 43. The forty-eight hour processor-to-controller clock is the operational trap: it is shorter than the seventy-two hour regulator clock and runs from the processor's own awareness, which means a global supplier's standard 'notify without undue delay' contract term is not enough for Kenya. Notification to data subjects is required where the breach is likely to result in real risk to their rights and freedoms. The National Computer and Cybercrimes Co-ordination Committee operates a reporting form under the Computer Misuse and Cybercrimes Act, 2018, and we could not find a published hour-count deadline on its site — recorded as no deadline found rather than no deadline existing.

(1) Children: the Act defines a child as under eighteen; the General Regulations, 2021, regulation 13 prohibits profiling a child in relation to direct marketing; the November 2025 children's guidance note requires 'appropriate mechanisms for age verification and consent'. There is no lower digital-consent age as in Europe. (2) Criminal exposure: section 73 provides for a fine up to three million shillings (about 23,000 US dollars) or imprisonment up to ten years; the April 2026 microfinance determination shows the office actually recommending prosecution of directors for obstruction under section 61(b). The administrative cap in section 63 is the lower of five million shillings or one per cent of annual turnover — the 'lower of' drafting means the percentage limits large firms rather than exposing them. (3) Registration: Registration Regulations, 2021, regulation 9 gives a twenty-four month certificate; regulation 13 sets the exemption; the Third Schedule lists twelve activities where the exemption does not apply, including gambling, financial services, telecommunications, direct marketing, health administration, education, hospitality, property management, transport and genetic data. (4) Sensitive data: regulation 46 conditions transfer of sensitive personal data on the data subject's consent, so a safeguards-based route alone will not carry health, biometric or similar data out of Kenya. (5) The protected-systems hook: the communications guidance states that most service providers are protected computer systems under the Computer Misuse and Cybercrimes Act and therefore fall inside regulation 26. That designation sits with the government, not with you, which makes it a live risk rather than a fixed scope.

DORMANT SWITCHES, in order of how fast they could hurt. (1) Section 50 of the Act lets the Cabinet Secretary, on the Data Commissioner's recommendation, prescribe further categories of processing that must stay on Kenyan servers, on the grounds of the strategic interests of the state or the protection of revenue. The revenue ground has never been used and would reach ordinary commercial data if it were. (2) The 'protected computer system' designation under the Computer Misuse and Cybercrimes Act, 2018 automatically pulls whatever it touches into regulation 26 localisation. The privacy regulator already treats most communications providers as caught; extending it to other operators requires no change to the data protection rules at all. (3) Regulation 44 lets the Data Commissioner declare countries adequate and publish the list. No published list was found, which cuts both ways: nothing is blessed, and nothing is blocked, but the office could reshape the transfer map by publishing a narrow list. Also unresolved: the term of office of the current Data Commissioner, which we could not verify and which is a natural point of discontinuity. No pending data protection bill was found on Parliament's own bills listing, checked 18 August 2026.