Business Continuity Plan (Kenya)

A Business Continuity Plan in Kenya documents the business continuity plan in a form the parties and authorities can rely on.

In Kenya, BCP requirements are imposed by several regulatory frameworks. The Central Bank of Kenya (CBK), exercising its powers under the Central Bank of Kenya Act (Cap. 491) and the Banking Act (Cap. 488), has issued the Prudential Guideline on Business Continuity Management (CBK/PG/19) applicable to all licensed banks, microfinance banks, and payment service providers. Regulated institutions must maintain a documented, tested BCP and submit BCP certificates to CBK as part of their annual compliance submissions. The Insurance Regulatory Authority (IRA), under the Insurance Act (Cap. 487), similarly requires IRA-licensed insurers to maintain BCPs as part of their operational resilience obligations.

The Data Protection Act No. 24 of 2019, enforced by the Office of the Data Protection Commissioner (ODPC), requires data controllers and processors to implement appropriate technical and organisational measures to protect personal data — including measures to restore data availability following a physical or technical incident. Section 41 of the Data Protection Act requires notification to the ODPC within 72 hours of a data breach. A BCP that includes IT disaster recovery and data backup procedures directly supports compliance with these ODPC obligations.

The Capital Markets Authority (CMA) of Kenya, under the Capital Markets Act (Cap. 485A), requires licensed stockbrokers, investment advisers, and fund managers to maintain BCPs as part of their operational risk management frameworks. The Communications Authority of Kenya (CA) imposes BCP obligations on licensed telecommunications operators. The Energy and Petroleum Regulatory Authority (EPRA) requires energy sector licensees to maintain emergency response plans consistent with BCP principles.

Beyond regulatory requirements, a Kenya BCP is a critical governance document for any organisation seeking ISO 22301:2019 (Business Continuity Management Systems) certification — the international standard adopted by Kenya Bureau of Standards (KEBS) as KS ISO 22301. ISO 22301 certification is increasingly required by multinational clients, development finance institutions such as the African Development Bank (AfDB), and international procurement processes. A BCP aligned with ISO 22301 demonstrates organisational maturity and operational resilience to investors, lenders, and counterparties. Under Kenya law, Section 3 of the Companies Act 2015 (No. 17 of 2015) and Section 2 of the Law of Contract Act (Cap 23) govern the core requirements for this type of document.

The legal framework governing the Business Continuity Plan (Kenya) in Kenya draws on several key statutes and regulatory bodies. Under the Companies Act No. 17 of 2015, the Registrar of Companies at the Office of the Attorney General maintains the register of Kenyan companies. Section 3 of the Law of Contract Act (Cap. 23) governs contractual obligations. The Competition Authority of Kenya (CAK) enforces the Competition Act No. 12 of 2010. The Kenya Revenue Authority (KRA) administers corporate tax under the Income Tax Act (Cap. 470). The High Court of Kenya has unlimited original jurisdiction under Article 165 of the Constitution of Kenya 2010. Parties executing a Business Continuity Plan (Kenya) in Kenya should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Central Bank of Kenya Prudential Guidelines on Business Continuity Management sets the foundational requirements.

A Kenya Business Continuity Plan is required by regulation or strongly recommended by best practice in several distinct circumstances.

A BCP is required when an organisation holds a licence from the Central Bank of Kenya (CBK) — including commercial banks, microfinance banks, Forex bureaus, and mobile money operators — under the Central Bank of Kenya Act (Cap. 491) or the Banking Act (Cap. 488). CBK Prudential Guideline CBK/PG/19 mandates a documented, board-approved BCP with annual testing and review.

A BCP is needed when a company registered with the Business Registration Service (BRS) via the eCitizen portal processes personal data of customers or employees and is therefore a data controller or processor under the Data Protection Act No. 24 of 2019. The ODPC's data breach notification obligation within 72 hours under Section 41 of the Act cannot be met without a pre-planned incident response procedure documented in a BCP.

A BCP is required when an organisation is bidding for a public procurement contract under the Public Procurement and Asset Disposal Act No. 33 of 2015. The Public Procurement Regulatory Authority (PPRA) may require evidence of business continuity capacity as part of technical evaluation criteria for contracts in ICT, healthcare, security, and infrastructure sectors.

A BCP is needed when an organisation operates in a sector subject to significant operational disruption risk — including logistics companies managing supply chains across Mombasa Port, Nairobi's Industrial Area, and upcountry distribution networks; hospitals and clinics subject to the Medical Practitioners and Dentists Act (Cap. 253); and schools regulated by the Basic Education Act No. 14 of 2013.

A BCP is required when a company seeks a loan facility from a development finance institution such as the Kenya Development Corporation (KDC), the East African Development Bank (EADB), or an international lender, where operational risk assessment forms part of the lender's due diligence.

A BCP is needed after any organisation has experienced a significant operational disruption — such as the 2007/2008 post-election violence, the 2023 el-Niño flooding affecting road networks and warehouses, or a ransomware attack — and management wants documented procedures to prevent recurrence and accelerate future recovery.

A Kenya Business Continuity Plan covering critical operations under applicable CBK prudential guidelines and the Data Protection Act No. 24 of 2019 must include the following essential elements.

Organisation Profile and Scope: The name, BRS registration number, industry sector, and geographic locations of the organisation. The scope statement identifies which business functions, products, services, locations, and systems are covered by the BCP. Regulated entities should cross-reference the applicable CBK, IRA, or CMA licence number.

Risk Assessment and Threat Identification: A structured assessment of internal and external threats — natural disasters (flooding, fire, earthquake), cyber threats (ransomware, phishing, data breaches), infrastructure failures (Kenya Power outages, telecommunications disruption), civil unrest, supply chain failures, and pandemic health emergencies. Each threat is assessed for probability and impact using a defined risk matrix.

Business Impact Analysis (BIA): Identification of mission-critical business functions, the maximum tolerable period of disruption (MTPD) for each function, the recovery time objective (RTO — how quickly each function must be restored), and the recovery point objective (RPO — how much data loss is acceptable). The BIA findings drive prioritisation of recovery resources.

Recovery Strategies and Procedures: Step-by-step procedures for activating the BCP, relocating to an alternative operating site or enabling remote work, restoring IT systems from backup, communicating with staff, clients, regulators (including the ODPC within 72 hours for data breaches), and suppliers during an incident. Procedures should name specific staff members and their alternates.

IT Disaster Recovery and Data Backup: The backup schedule, backup media, off-site storage location, and the procedure for restoring systems from backup. Section 41 of the Data Protection Act No. 24 of 2019 requires personal data to be protected against accidental loss or destruction. The BCP should specify the cloud backup provider, the encryption standard used, and the frequency of backup testing.

Crisis Communication Plan: Contact lists for all staff (with alternates), key clients, suppliers, CBK or other regulatory contacts, and public communications channels. The plan should designate the authorised spokesperson for external communications and define the protocol for notifying the Office of the Data Protection Commissioner (ODPC) and other regulatory authorities of incidents.

BCP Testing and Exercise Schedule: The schedule for tabletop exercises (at least annually), simulation drills (at least annually), and full failover tests. CBK Prudential Guideline CBK/PG/19 requires tested BCPs — a plan that has never been tested does not satisfy the regulator's requirements.

Governance and Maintenance: The BCP owner (typically the Chief Risk Officer or equivalent), the board approval date, the review schedule (at least annually and after every significant operational incident), and the change control procedure. Forms-legal.com provides this Business Continuity Plan template as a starting framework for Kenyan organisations seeking compliance with CBK guidelines and ISO 22301 principles. Organisations in regulated sectors should engage a qualified business continuity professional — certified under the Business Continuity Institute (BCI) or the Disaster Recovery Institute International (DRII) — to validate the plan before submitting it to a regulator. Under Kenya law, Section 3 of the Companies Act 2015 (No. 17 of 2015) and Section 2 of the Law of Contract Act (Cap 23) govern the core requirements for this type of document. Under Kenya law, Section 15 of the Employment Act 2007 (No. 11 of 2007) and Section 24 of the Land Registration Act 2012 (No. 3 of 2012) govern the core requirements for this type of document.