What Is Data Protection Act, 2019 (Cap. 411C)?
Kenya's operative statute is the Data Protection Act, 2019, codified as Cap. 411C. It was assented to on 8 November 2019 and commenced on 25 November 2019. The current consolidated Kenya Law text is dated 31 December 2022, with displayed revision through the 24th Annual Supplement and Legal Notice 221 of 2023 effective 30 January 2024. No later enacted amendment was located. The Act has a notable distinction between §26’s deletion right for false or misleading data and §40’s more qualified erasure right for unauthorized, irrelevant, excessive, or unlawfully retained data. It also provides commercial-use protection, portability, restriction, automated-decision safeguards, and complaint and compensation routes. The ODPC complaint process has unusually concrete timing: acknowledgment within seven days, generally 21 days for a respondent response, a 90-day investigation or inquiry conclusion deadline under §56, and communication of the decision within seven days. No dedicated data-broker or public-record challenge process was located, although an ODPC determination addresses third-party-sourced contact data and marketing, including an erasure request.
At a glance
- Full name
- Data Protection Act, 2019 (Cap. 411C)
- Short code
- Data Protection Act 2019
- Jurisdiction
- Kenya
- Enacted
- 2019
- Last major update
- Current consolidated Kenya Law text dated 31 December 2022, with displayed revision through the 24th Annual Supplement and Legal Notice 221 of 2023 effective 30 January 2024; no later enacted amendment was located
- Regulator
- Office of the Data Protection Commissioner (ODPC)
- Private right of action
- Yes
- Statutory citation
- Data Protection Act, 2019 (Cap. 411C)
Scope, who Data Protection Act 2019 covers
Protected data
Data subject rights
Right to be informed of data use
Right of access
Right to object to all or part of processing
Right under §26 to deletion of false or misleading data
Right to withdraw consent under §32, without invalidating earlier lawful processing
Right to restriction of processing under §34 in specified circumstances
Protection against solely automated decisions with significant effects, including reconsideration or a non-automated decision under §35
Protection against commercial use without express consent or written-law authority and notice under §37
Right to portability under §38, with a 30-day handling deadline subject to exceptions and extensions
Right under §40 to rectification of inaccurate, outdated, incomplete, or misleading data and erasure of unauthorized, irrelevant, excessive, or unlawfully retained data
Right to complain to the Data Commissioner and seek compensation for damage caused by a contravention
Notable features
Kenya’s unusual features include the lower-of-two administrative-fine structure, the distinct §26 deletion and §40 erasure provisions, and a concrete 90-day statutory deadline for ODPC investigation or inquiry conclusions, with seven-day acknowledgment and decision-communication periods.
Enforcement & penalties
Regulator: Office of the Data Protection Commissioner (ODPC)
Penalties: An administrative fine under §63 may reach KSh 5 million or 1% of annual turnover for an undertaking, whichever is lower. Non-compliance with an enforcement notice under §58(3), or obstruction or failure to assist the Commissioner under §61, may attract up to KSh 5 million, imprisonment for up to two years, or both. The general criminal penalty under §73 is up to KSh 3 million, imprisonment for up to ten years, or both. Regulation 20(4) provides a daily penalty of up to KSh 10,000 for each day of an unrectified breach.
Private right of action: Section 65 provides compensation for damage caused by a contravention, distinct from the ODPC complaint procedure under §56 and subject to applicable facts and statutory exceptions.
Relevance to data brokers
No Kenya-specific data-broker complaint form, registry route, public-record challenge process, or dedicated public-record deletion portal was located. ODPC does publish a general complaint-submission route and current determinations; those are regulator routes for alleged DPA violations, not dedicated broker deletion procedures. Section 28 permits indirect collection of public-record data but is not a blanket data-protection exemption. ODPC Determination No. 0624 of 2023 provides a real data-broker-adjacent precedent involving third-party-sourced contact data and marketing, including an erasure request, but does not establish a dedicated broker procedure.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
What is the difference between deletion and erasure under Kenya’s Act?+
Section 26 provides a deletion right for false or misleading data. Section 40 separately provides a more qualified erasure right for unauthorized, irrelevant, excessive, or unlawfully retained data; the two provisions should not be treated as one uniform right.
How long does the ODPC have to conclude an investigation or inquiry?+
Section 56 provides a 90-day investigation or inquiry conclusion deadline. The process also includes acknowledgment within seven days, generally 21 days for a respondent response, and decision communication within seven days after determination.
Does Kenya have a dedicated data-broker deletion portal?+
No Kenya-specific data-broker deletion portal or dedicated broker procedure was located. ODPC does provide a general complaint route for alleged Data Protection Act violations, and its determinations include data-broker-adjacent matters, but neither establishes a dedicated broker deletion process.
Official sources & citations
Other international privacy regimes
Data Protection Act 2019 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: