Data Protection Act, 2019 (Kenya)

The Data Protection Act, 2019 is Kenya’s primary data protection legislation governing the processing, collection, storage, use, disclosure, and protection of personal data by public and private entities. The Act establishes obligations for data controllers and processors, provides individuals with rights over their personal information, regulates sensitive personal data processing, introduces consent and transparency requirements, and sets rules for data security and cross-border transfers. The legislation establishes the Office of the Data Protection Commissioner (ODPC) as the regulatory authority responsible for supervision and enforcement of Kenya’s privacy framework.