← Global Privacy Laws Research Library
Data Protection Act No. 24 of 2019
Data Protection Act, 2019: Kenya
Prepared by Shubhank Suman · Last reviewed
CURRENT
- Legal character
- Act of Parliament
- Region
- Africa
- Date of commencement
- 25 November 2019
What it covers
The Act regulates:
- processing
- controllers/processors
- data-subject rights
- registration
- security
- DPIAs
- transfers
- breaches
- enforcement
- special personal data.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: Very High
AI
HIGH
The Act is not an AI Act, but is relevant to:
- biometric AI
- automated decisionmaking
- profiling
- AI monitoring
- AI systems processing sensitive data.
The ODPC continues to develop guidance for high-risk processing, DPIAs and sector-specific AI/data issues.
Cybersecurity
VERY HIGH
Security and breach response are central.
The ODPC continues to operate a formal breach-reporting process built around the statutory 72-hour requirement. (Data Protection Commissioner)
Applicability
Public/private controllers and processors within the Act's territorial scope.
Current validity
CURRENT AND IN FORCE.
Read first
Section 25 → rights → controller/processor → Section 31 DPIA → security → Section 43 breach → transfer provisions → 2021 Regulations.
Provisions / sections covered
Section 25: Processing principles
Core lawful-processing principles.
Data-subject rights
Include:
- information
- access
- objection
- correction
- deletion
- portability.
Section 31: DPIA
Where processing is likely to create high risk to rights/freedoms because of its nature, scope, context or purpose, a controller/processor must conduct a data protection impact assessment before processing.
The assessment must include:
- description of processing
- necessity/proportionality
- risks
- safeguards/security
- mitigation.
(dataprotection.co.ke)
Section 43: Breach notification
Where a personal-data breach creates a real risk of harm, the controller must notify the Data Commissioner without delay and within 72 hours of becoming aware.
Processors must notify controllers without delay and, where practicable, within 48 hours.
(dataprotection.co.ke)
CURRENT DEVELOPMENT
The ODPC continues to issue additional guidance and regulatory material. In September 2026 it published a draft notice concerning additional categories of sensitive personal data under Section 47. That is draft material, not yet to be presented as a final amendment to the Act. (Data Protection Commissioner)
Subject-matter tags
- Consent
- Sensitive data
- Data subject rights
- Erasure and deletion
- Data portability
- Profiling
- Automated decision-making
- Impact assessment
- Data breach
- Cross-border transfers
- Data protection officer
- Controller and processor
- Biometrics
- Enforcement and penalties
- Surveillance
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.