Kenya's Data Protection Act: five practical steps for SMEs

The Data Protection Act 2019 and its regulations apply broadly. You do not need to be a tech company to be caught — a payroll, a CRM and a CCTV system are enough. Here is a prioritised list for a small or mid-sized business.

1. Map your data

List what personal data you hold, where it lives, why you have it, who you share it with and how long you keep it. Everything else builds on this.

2. Check whether you must register

Data controllers and processors above the thresholds in the Registration Regulations must register with the Office of the Data Protection Commissioner and renew annually. Many businesses below the threshold register anyway to demonstrate good faith.

3. Fix your notices and consents

Your privacy notice should tell people, in plain language, what you do with their data and what rights they have. Where you rely on consent, it must be a genuine opt-in — pre-ticked boxes do not count.

4. Put contracts in place with your processors

Anyone who processes personal data on your behalf — a cloud provider, a payroll bureau, a marketing agency — needs a written data-processing agreement with the clauses the Act requires.

5. Prepare for the things that go wrong

Have a simple process for handling data-subject requests within the statutory timeline, and a breach-response plan so you can notify the Commissioner within 72 hours where required.

None of this is exotic, but regulators increasingly expect to see it. A data protection advocate can review where you stand and prioritise the gaps.

Get help from a verified advocate

This article is general information, not legal advice on your situation. If you need advice, describe your matter on Wakili Link and we will match you with a verified advocate who handles it.

• Regulatory & compliance lawyers in Kenya
• Data protection compliance
• How to verify an advocate in Kenya