Confidentiality Agreement (Kenya)

A Confidentiality Agreement in Kenya obliges the receiving party to keep the disclosing party's proprietary information secret. It restricts disclosure and use of designated confidential information between the disclosing and receiving parties.

Confidentiality agreements in Kenya are distinct from non-disclosure agreements (NDAs), though the terms are frequently used interchangeably in commercial practice. A Confidentiality Agreement is the broader term, often used in employment, investment, and technology contexts, while an NDA typically refers to the pre-contractual form signed before commercial negotiations. Both instruments achieve the same legal result — they create a contractual obligation of confidence that supplements the equitable duty of confidence recognised by Kenyan courts applying received English equity under Section 3 of the Judicature Act (Cap. 8).

The Data Protection Act No. 24 of 2019, enforced by the Office of the Data Protection Commissioner (ODPC), adds a statutory dimension to confidentiality obligations. Where the confidential information includes personal data — the names, identification numbers, medical records, financial details, or location data of identified or identifiable individuals — the receiving party becomes a data processor under the Data Protection Act, subject to the obligations in Section 35 (data processor contracts must be in writing; data must be processed only on documented instructions; technical and organisational security measures are mandatory). A Confidentiality Agreement that covers personal data must therefore incorporate data protection provisions consistent with the Data Protection Act No. 24 of 2019.

Kenya's rapidly growing tech sector — with companies in Nairobi's Silicon Savannah technology ecosystem, fintech firms regulated by the Central Bank of Kenya (CBK), and e-commerce platforms — relies heavily on confidentiality agreements to protect source code, algorithms, customer databases, proprietary business processes, and investment strategies. The Nairobi Centre for International Arbitration (NCIA) is the preferred dispute forum for commercial confidentiality disputes in Kenya, offering confidential arbitration proceedings under the NCIA Arbitration Rules 2015 and the Arbitration Act No. 4 of 1995 (revised 2022).

Kenya acceded to the Hague Apostille Convention in 2021, meaning that Kenyan confidentiality agreements bearing an apostille issued by the High Court Registrar are recognised in all 124 Hague Convention member states without further authentication — particularly relevant for cross-border technology and investment transactions involving Kenyan parties. Under Kenya law, Section 135 of the Companies Act 2015 (No. 17 of 2015) and Section 15 of the Employment Act 2007 (No. 11 of 2007) govern the core requirements for this type of document.

The legal framework governing the Confidentiality Agreement (Kenya) in Kenya draws on several key statutes and regulatory bodies. Under the Companies Act No. 17 of 2015, the Registrar of Companies at the Office of the Attorney General maintains the register of Kenyan companies. Section 3 of the Law of Contract Act (Cap. 23) governs contractual obligations. The Competition Authority of Kenya (CAK) enforces the Competition Act No. 12 of 2010. The Kenya Revenue Authority (KRA) administers corporate tax under the Income Tax Act (Cap. 470). The High Court of Kenya has unlimited original jurisdiction under Article 165 of the Constitution of Kenya 2010. Parties executing a Confidentiality Agreement (Kenya) in Kenya should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Law of Contract Act Cap. 23 sets the foundational requirements.

A Kenya Confidentiality Agreement is needed whenever a party is about to disclose sensitive business, technical, or personal information to another party and wishes to control how that information is used and who it may be shared with.

The Agreement is needed before commercial negotiations — a joint venture discussion, merger and acquisition due diligence, franchise arrangement, investment pitch, or licensing negotiation — where one party must share detailed financial, operational, or technical information to allow the other party to assess the opportunity. Without a signed Confidentiality Agreement, there is no contractual basis to restrain the receiving party from using the information for its own benefit or disclosing it to competitors.

A Confidentiality Agreement is required when engaging an external consultant, IT contractor, auditor, or advisor who will have access to the client's proprietary systems, customer database, financial records, or trade processes. The Agreement is particularly important under the Data Protection Act No. 24 of 2019, which requires a written data processing agreement — which must include confidentiality obligations — whenever personal data is processed by a third party on behalf of a data controller.

The Agreement is needed when a company is onboarding a new business partner — distributor, reseller, manufacturer, or supplier — who will receive confidential product specifications, pricing structures, customer information, or supply chain data. Supply chain confidentiality is increasingly important in Kenya's manufacturing, agricultural export, and pharmaceutical sectors.

A Confidentiality Agreement is required when a startup company is seeking angel investment or venture capital — investors and their due diligence teams will have access to detailed financial models, technology architecture, customer lists, and competitive strategy that the founders need to protect.

The Agreement is also needed between co-founders of a startup who are exploring a joint venture or sharing proprietary technology — even between individuals who trust each other, a written Confidentiality Agreement creates clear expectations and provides a foundation for the more detailed shareholders' agreement or co-founder agreement that will follow. Under Kenya law, Section 3 of the Companies Act 2015 (No. 17 of 2015) and Section 2 of the Law of Contract Act (Cap 23) govern the core requirements for this type of document.

A Kenya Confidentiality Agreement under the Law of Contract Act Cap. 23 and the Data Protection Act No. 24 of 2019 must include the following essential provisions to be thorough and enforceable.

Parties: Full legal names of the disclosing party and the receiving party, their addresses, KRA PINs, and BRS Registration Numbers if companies. For mutual agreements, both parties are simultaneously disclosing and receiving parties.

Definition of Confidential Information: A precise and inclusive definition of what constitutes confidential information — trade secrets, business plans, financial projections, customer and supplier lists, technical designs, source code, processes, formulas, pricing structures, employee information, and any personal data as defined in the Data Protection Act No. 24 of 2019. The definition should include oral as well as written disclosures, and information derived or generated from confidential information.

Exclusions from Confidentiality: Standard carve-outs for information that: was in the public domain before disclosure; becomes public through no breach by the receiving party; was independently developed by the receiving party; or was received from a third party without restriction. Required disclosures to regulatory authorities (KRA, CBK, CMA, ODPC) or pursuant to a court order must also be carved out, provided the receiving party notifies the disclosing party promptly.

Permitted Purpose: A specific statement of the purpose for which the confidential information may be used — for example, evaluation of a potential joint venture, due diligence for a share acquisition, or performance of a specific service contract. Use of confidential information for any other purpose without written consent is a breach.

Obligation of Confidence: An express covenant that the receiving party shall: hold confidential information in strict confidence; not use it for any purpose other than the permitted purpose; not disclose it to third parties without the disclosing party's prior written consent; and restrict access to employees, directors, or advisers with a need to know, who are themselves bound by equivalent confidentiality obligations.

Data Protection Compliance: Where the confidential information includes personal data, the Agreement must identify the receiving party as a data processor under Section 35 of the Data Protection Act No. 24 of 2019, require processing only on the disclosing party's documented instructions, require implementation of appropriate technical and organisational security measures, and require notification of any personal data breach within 72 hours of discovery.

Term and Survival: The duration of the confidentiality obligations — typically 2 to 5 years from the date of the Agreement, or 2 to 3 years after the termination of the underlying business relationship. Trade secrets and personal data obligations commonly survive indefinitely.

Remedies for Breach: An acknowledgement that breach of the Agreement will cause irreparable harm for which damages are an inadequate remedy, entitling the disclosing party to seek an injunction or other equitable relief from the High Court of Kenya or the Nairobi Centre for International Arbitration (NCIA) without the need to prove actual financial loss.

Governing Law and Dispute Resolution: The Agreement shall be governed by the laws of Kenya. Disputes may be referred to the Nairobi Centre for International Arbitration (NCIA) under the Arbitration Act No. 4 of 1995 (revised 2022), or to the High Court of Kenya. Forms-legal.com provides this Confidentiality Agreement as a practical starting point for Kenyan businesses and individuals protecting sensitive commercial and personal information. Under Kenya law, Section 135 of the Companies Act 2015 (No. 17 of 2015) and Section 15 of the Employment Act 2007 (No. 11 of 2007) govern the core requirements for this type of document.