Where Does My Data Live? Data Residency for Kenyan Businesses
Here is a fun question to ask at your next management meeting: where, physically, is our customer data right now? Watch the room. Someone will point at the ceiling. Someone will say "in the system". Fatuma from finance will say "on my laptop, obviously", and the IT person will quietly put their head in their hands. Welcome to the surprisingly lively topic of data residency in Kenya.
The honest answer for many Kenyan businesses is: somewhere in Europe, America or South Africa, depending on which services you signed up for. Your customer list may be more widely travelled than most of your staff. That is not automatically a problem, but it is something you should know.
What data residency means for Kenyan businesses
Data residency simply means the physical location where your data is stored and processed. When you use a cloud service, your files sit on servers in a specific data centre, in a specific country. Big providers have data centres in many regions, and some now have facilities on the African continent, including options in or close to Kenya.
Why does location matter? Because the laws of the country where data sits can affect who can access it, and because Kenyan law has its own expectations about personal data that leaves the country.
What Kenyan law says, in general terms
Kenya's Data Protection Act 2019 sets rules for how organisations collect and handle personal data, and the Office of the Data Protection Commissioner (ODPC) oversees it. The Act and its regulations include provisions on transferring personal data outside Kenya, and certain kinds of processing may be expected to happen locally.
The details depend on what kind of data you hold and what sector you are in, and they can change. This article is not legal advice, so if you handle sensitive data such as health records, financial information or children's details, speak to a qualified advocate about your specific obligations. What every business can do, though, is get the basics right:
Know what personal data you collect: names, phone numbers, ID numbers, M-Pesa details, medical notes and so on
Know where each system that holds it stores its data
Make sure you have a lawful reason for collecting it and are not keeping it forever just in case
Check whether your contracts with cloud providers cover data protection properly
Questions to ask any cloud provider
Before you sign up for a new service, or when you next review an existing one, ask:
Which country or region will our data be stored in?
Can we choose the region, or is it decided for us?
Who at your company can access our data, and under what circumstances?
If we leave, how do we get our data out, and in what format?
How do you handle a data breach, and how quickly would you tell us?
A reputable provider will have written answers to all of these, usually somewhere in their documentation or data processing agreement. If the sales person answers with "don't worry, it's very secure", worry a little.
Local versus international: the trade-offs
Keeping data in or near Kenya can mean faster access for local users and an easier conversation about compliance. Using a large international region can mean more services, more mature tooling and sometimes lower costs. Neither is always right. Kiprop, who runs a small logistics company, keeps his customer database in a regional data centre for speed and stores marketing files on a global service because nobody minds if a brochure takes an extra second to load.
The point is to make the choice deliberately rather than by accident, which is how most of us ended up with our data scattered across four continents and a flash disk in Fatuma's handbag.
A simple next step
Make a one page table. List each system your business uses, what personal data it holds and where that data lives. It might take an afternoon and a few emails to providers. But the next time the board, an auditor or a big client asks "where is our data?", you can hand them a page instead of pointing at the ceiling.
If some of the systems on that page are custom built and nobody is sure where they store anything, our team can help you find out. For everything else, a polite email to each provider asking "which region is our data in?" is a fine place to begin.