Kenya · Data protection
The duties the Data Protection Act 2019 places on data controllers and processors — registration, DPO publication, collection rules, high-risk consultation — published with verified citations to the consolidated Act.
Where this comes from
Kenya's data protection regime is enforced by the Office of the Data Protection Commissioner, and its obligations reach any organisation processing personal data of Kenyan data subjects — local or foreign. The pack compiles the Data Protection Act 2019 (Cap. 411C) to section level: 1,408 provisions across 4 instruments.
The KE-DATA-PROTECTION pack currently publishes 33 published data-controller obligations. Every published row carries a verified quote span from the consolidated instrument, an explicit review decision, and version history. Published rows are a reviewed subset of the compiled regulatory corpus — depth keeps growing under the same publication policy.
This page is maintained by the Esheria Legal Team. Facts shown here come from published pack rows with verified quote spans, and none of it is legal advice.
Key obligations
Registered data controllers must notify the Data Commissioner of any change to the particulars in their registration. Stale registrations are a compliance gap regulators can see. (Section 19(5), Data Protection Act, 2019 (No. 24 of 2019, Cap. 411C).)
Where a data protection officer is appointed, the organisation must publish the DPO's contact details on its website and communicate them to the Data Commissioner. (Section 24(6), Data Protection Act, 2019 (No. 24 of 2019, Cap. 411C).)
Personal data must be collected directly from the data subject, subject only to the exceptions the Act itself sets out. Indirect collection needs a lawful basis. (Section 28(1), Data Protection Act, 2019 (No. 24 of 2019, Cap. 411C).)
Where a data protection impact assessment shows that processing would result in high risk, the data controller must consult the Data Commissioner before processing starts. (Section 31(3), Data Protection Act, 2019 (No. 24 of 2019, Cap. 411C).)
Sources & related
Consolidated text as at 2022-12-31 — the exact source the published pack rows cite. Opens the official PDF.
OpenEverything Esheria publishes for Kenya: case law, five regulatory domains, and how teams put them to work.
OpenAsk questions in plain language and get answers pinned to reported Kenyan cases and statute sections.
OpenPull these obligations, filing rules, forms and citations into your own product or compliance workflow.
OpenTalk to the team
Mapping your Kenyan data protection exposure? Tell us about your processing footprint and we will show you the published obligations that apply.
Or email hello@esheria.ai