Kenya's Data Protection Act Explained Without Putting You to Sleep
Raise your hand if you have ever collected a customer's ID number, phone number or date of birth. Now keep it raised if you know exactly where all those details are stored right now. Ah. Most hands just came down. That is exactly why the Data Protection Act in Kenya matters to ordinary businesses, not just banks and telcos. Grab a cup of chai, and we promise to keep this lively.
A quick note before we start: this is a friendly overview, not legal advice. For your specific situation, speak to an advocate or check guidance from the Office of the Data Protection Commissioner.
What the Data Protection Act in Kenya is about
Kenya passed the Data Protection Act in 2019. Its basic idea is simple and quite reasonable: personal information belongs to the people it describes, and organisations that collect it must handle it carefully, fairly and transparently.
The Act also created the Office of the Data Protection Commissioner, the ODPC, which oversees compliance, handles complaints and registers organisations that process personal data. Many businesses are required to register, depending on their size and activities, so it is worth checking whether that includes you.
What counts as personal data?
More than people think. Personal data is any information that can identify a living person, either on its own or combined with other details. In everyday business terms, that includes:
Names, phone numbers, email and physical addresses
ID and passport numbers, and KRA PINs
Photos and CCTV footage of identifiable people
Employee records, payslips and medical information
Student records and parents' contact details
Client case files, account details and payment information
Some categories, such as health information, are treated as sensitive and deserve extra care. So that folder of scanned IDs on the reception computer? Yes, that counts.
The core principles, in plain language
The Act sets out principles for handling personal data. Translated from legal language into office language, they mean roughly this:
Be open: tell people what you collect and why
Collect only what you need, not everything just in case
Use it only for the purpose you collected it for
Keep it accurate and up to date
Do not keep it forever without a reason
Keep it secure from loss, theft and nosy colleagues
People also have rights, including the right to be informed, to access their data, to have errors corrected and, in some cases, to have data deleted or to object to its use.
Practical steps for a small business
You do not need a legal department to make real progress. Start here:
Make a list of what personal data you hold, where it lives and who can access it
Stop collecting details you do not actually use
Move customer and staff records out of personal phones and WhatsApp groups
Restrict access, so only people who need the data can see it
Use strong passwords and two-factor authentication on systems with personal data
Write a short privacy notice explaining what you collect and why
Check whether you need to register with the ODPC
Achieng, who runs a small clinic, started with the list. She found patient details in a notebook, on two laptops, in the receptionist's phone and in a shared folder that was accessible to everyone, including the intern who had left months ago. Fixing that took a week. Discovering it took one afternoon.
Good systems make compliance easier
Much of data protection is about knowing where data lives and controlling who sees it. That is very hard with paper files and scattered spreadsheets, and much easier with proper business systems that have user accounts, permissions and audit trails.
This is one reason schools move student records into platforms like SchoolPoint and HR teams keep staff files in systems like OfficeCUBE rather than in a drawer. The software does not make you compliant on its own, but it makes good habits much easier to keep.
Your next step: this week, sit down with your team and list every place customer or staff data is stored. Be honest, include the notebooks. That one list will tell you exactly where to start, and you will have stayed awake for the whole thing.