Data Processing Agreement (Kenya)

A Data Processing Agreement in Kenya sets out the rights, duties and consideration binding the parties to it.

The Data Protection Act No. 24 of 2019 defines a data controller as a natural or legal person who determines the purpose and means of processing personal data, while a data processor is a person who processes data on behalf of a controller. Common examples in Kenya include: a company (controller) engaging a cloud hosting provider or payroll bureau (processor); a hospital (controller) using a medical records management company (processor); or a bank (controller) outsourcing customer KYC verification to a fintech firm (processor). The distinction is significant because the Data Protection (General) Regulations 2021 impose direct liability on processors who exceed the instructions of the controller or who subcontract processing without prior written authorisation.

The legal basis for data processing in Kenya is grounded in Section 30 of the Data Protection Act No. 24 of 2019, which requires that processing have at least one lawful basis: consent, contractual necessity, legal obligation, vital interests, public task, or legitimate interests. A Data Processing Agreement must identify the applicable lawful basis and specify the categories of data subjects and personal data involved. The High Court of Kenya (Constitutional and Human Rights Division) has jurisdiction over constitutional data rights claims under Article 31 of the Constitution of Kenya 2010, which protects the right to privacy including the right to the protection of personal data.

A Kenya Data Processing Agreement differs from a Data Sharing Agreement in an important respect: a DPA governs processing by a third-party service provider acting under instructions, where the processor has no independent decision-making authority over the data. A Data Sharing Agreement, by contrast, governs the transfer of data between two independent controllers, each determining their own processing purposes. Both types of agreements are required by the ODPC, and a single transaction may require both instruments — for example, where two hospitals share patient records (Data Sharing Agreement) and each then engages a cloud provider (Data Processing Agreement).

The Data Protection (General) Regulations 2021 (Legal Notice No. 46 of 2021), made under Section 72 of the Data Protection Act, elaborate the requirements for controller-processor contracts and set out the mandatory provisions that every Data Processing Agreement in Kenya must contain. Processors operating across East Africa must also consider whether the General Data Protection Regulation (GDPR) of the European Union applies to their activities if they process data of EU residents — Kenya's ODPC has acknowledged GDPR adequacy considerations in cross-border data transfer guidance.

Organisations that have already adopted a Data Breach Notification Template and Cybersecurity Policy gain additional compliance benefit from a Data Processing Agreement that formally extends those security obligations to all third-party processors. Without a written Data Processing Agreement, a controller cannot demonstrate to the ODPC during an audit that its processor supply chain meets the security standards required by Section 41 of the Data Protection Act No. 24 of 2019.

A Kenya Data Processing Agreement is required whenever a data controller engages a third-party service provider to process personal data on its behalf, and the Data Protection Act No. 24 of 2019 makes written documentation of this relationship mandatory before processing begins.

A Data Processing Agreement is required when a Kenyan business engages a Software-as-a-Service (SaaS) provider, cloud hosting company, or IT services firm that will have access to customer or employee personal data. Under Section 43(1) of the Data Protection Act No. 24 of 2019, the processor must be bound by a written contract before accessing any personal data. Failure to execute a DPA before the service goes live exposes the controller to enforcement action by the Office of the Data Protection Commissioner (ODPC), including formal investigations and penalty notices.

A Data Processing Agreement is needed when a company registered with the Business Registration Service (BRS) outsources its human resources or payroll functions to a third-party bureau. Payroll processing involves sensitive personal data — National Identity Card (NIC) numbers, KRA PINs, NSSF membership numbers, SHIF registration numbers, salary details, and banking information — all of which are classified as personal data requiring protection under the Data Protection Act No. 24 of 2019.

A Data Processing Agreement is required when a healthcare facility, pharmacy, or diagnostic laboratory in Kenya contracts a third-party records management company, medical transcription service, or electronic health records platform. Health data constitutes sensitive personal data under Section 2 of the Data Protection Act, and its processing requires both a lawful basis and explicit patient consent under Section 32.

A Data Processing Agreement is needed when a financial institution regulated by the Central Bank of Kenya (CBK) or the Capital Markets Authority (CMA) engages a data analytics firm, credit reference bureau, or customer verification service. The CBK Prudential Guidelines and the CMA regulations require institutions to confirm that all outsourced data processing complies with the Data Protection Act No. 24 of 2019.

A Data Processing Agreement is required when a Kenyan company transfers personal data to a processor located outside Kenya. Section 49 of the Data Protection Act restricts cross-border transfers to countries with adequate data protection laws or where the ODPC has approved appropriate safeguards. A DPA incorporating the standard contractual clauses recognised by the ODPC provides the legal mechanism for such transfers.

A Data Processing Agreement is needed when a marketing agency, advertising technology company, or market research firm processes consumer personal data on behalf of a brand or retailer operating in Kenya's consumer goods or telecommunications sector. The Data Subject Consent Form used to collect marketing consent should reference the Data Processing Agreement governing the processor's handling of that data.

A Kenya Data Processing Agreement under the Data Protection Act No. 24 of 2019 must contain the following essential elements to satisfy the requirements of Section 43 and the Data Protection (General) Regulations 2021.

Identification of Parties: Full legal names, BRS registration numbers, KRA PINs, and registered addresses of the data controller and data processor. Clarity about the roles is mandatory — confusing controller and processor status creates direct legal liability under the Data Protection Act No. 24 of 2019 and exposes both parties to enforcement by the Office of the Data Protection Commissioner (ODPC).

Scope and Subject Matter of Processing: A precise description of the processing operations, the categories of personal data involved (for example, names, NIC numbers, KRA PINs, financial data, health data), the categories of data subjects (employees, customers, patients), and the purpose for which the controller has instructed the processor to process the data. Vague descriptions that do not specify the lawful basis under Section 30 of the Data Protection Act will not satisfy the ODPC's audit requirements.

Processor Obligations: The processor must process personal data only on the controller's documented instructions; maintain confidentiality of personal data; implement appropriate technical and organisational security measures under Section 41 of the Data Protection Act; and delete or return all personal data to the controller on termination of the agreement. The Data Protection (General) Regulations 2021 require the processor to assist the controller in responding to data subject access requests under Section 26 and breach notifications under Section 43(5).

Sub-processing: The agreement must specify whether the processor may engage sub-processors and, if so, require prior written authorisation from the controller for each sub-processor. The processor remains liable to the controller for any sub-processor's acts or omissions as if the processor itself had performed them — this chain of liability is established by Section 43(3) of the Data Protection Act No. 24 of 2019.

Data Subject Rights Assistance: The processor must assist the controller in fulfilling data subjects' rights under Sections 26 to 35 of the Data Protection Act — including rights of access, rectification, erasure, restriction, portability, and objection — within the timeframes specified by the ODPC. Data subjects whose rights are infringed may lodge complaints directly with the ODPC under Section 56 of the Act.

Security Measures: The parties must agree on the technical and organisational security measures appropriate to the risk, including encryption, access controls, pseudonymisation, regular security testing, and physical security protocols. The Data Protection (General) Regulations 2021 specify minimum security standards for high-risk processing activities, including health data and financial data. The controller's Cybersecurity Policy should be referenced as the baseline security standard that the processor must meet.

Personal Data Breach Notification: The processor must notify the controller without undue delay — and in any event within 24 hours — of becoming aware of a personal data breach, to enable the controller to notify the ODPC within the 72-hour window required by Section 43(6) of the Data Protection Act. The forms-legal.com Data Processing Agreement template includes a breach notification procedure aligned with the ODPC's reporting requirements and the Data Breach Notification Template.

Duration and Termination: The duration of the processing relationship, the consequences of termination (including secure deletion or return of all personal data within a specified period), and the right of either party to terminate immediately for material breach of the data protection obligations.

Audit Rights: The controller must have the contractual right to audit the processor's data protection compliance, either directly or through an independent third party. Processors must cooperate with ODPC inspections under Section 30 of the Data Protection (General) Regulations 2021 and make available all records of processing activities.

Governing Law: Kenya law governs the agreement, with disputes referred to the courts of Kenya or the Nairobi Centre for International Arbitration (NCIA) under the Arbitration Act No. 4 of 1995 (revised 2022). For cross-border processing, the agreement should specify the data transfer mechanism under Section 49 of the Data Protection Act No. 24 of 2019.