Privacy Policy (Kenya)

A Privacy Policy in Kenya sets out the rules and standards the organisation expects those it covers to follow.

Section 25 of the DPA 2019 sets out the data protection principles that every data controller and processor must observe. Personal data must be processed lawfully, fairly, and transparently (Section 25(a)); collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes (Section 25(b)); adequate, relevant, and limited to what is necessary (Section 25(c)); accurate and kept up to date (Section 25(d)); not kept longer than necessary (Section 25(e)); and processed with appropriate technical and organisational security measures (Section 25(f)). A Privacy Policy is the primary mechanism by which a data controller demonstrates compliance with the transparency principle under Section 25(a).

The DPA 2019 distinguishes between a data controller — a person who determines the purpose and means of processing — and a data processor — a person who processes data on behalf of a data controller. Both categories must register with the ODPC under Section 17 of the Act once the Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021 came into force. The annual registration fee is KES 5,000 for small organisations and KES 50,000 for large organisations, as defined in the Regulations.

A Kenya Privacy Policy must identify the lawful basis for each category of processing. Under Section 30 of the DPA 2019, the lawful bases available to a data controller include: consent of the data subject (Section 30(a)); performance of a contract (Section 30(b)); compliance with a legal obligation (Section 30(c)); protection of vital interests (Section 30(d)); public interest or official authority (Section 30(e)); and legitimate interests (Section 30(f)). Consent, where relied upon, must be freely given, specific, informed, and unambiguous under Section 32 of the DPA 2019.

The DPA 2019 grants data subjects a suite of rights: the right to access personal data (Section 26(a)); the right to rectification of inaccurate data (Section 26(b)); the right to erasure (Section 26(c)); the right to object to processing (Section 26(d)); the right to data portability (Section 26(e)); and the right not to be subject to automated decision-making (Section 26(f)). The Privacy Policy must explain how data subjects can exercise each of these rights and the timeframe within which the data controller will respond.

Cross-border transfers of personal data outside Kenya are regulated under Section 48 of the DPA 2019. Transfers are permitted where the destination country has adequate data protection laws, where the data subject has consented, where standard contractual clauses have been used, or where binding corporate rules are in place. A Privacy Policy for any Kenyan business that shares data with foreign service providers — including cloud platforms, email marketing tools, or analytics providers hosted outside Kenya — must address cross-border transfers and the safeguards in place.

The Data Protection (General) Regulations 2021 published under the DPA 2019 further detail the content requirements for privacy notices, the procedures for handling data subject rights requests, and the records of processing activities that must be maintained. Non-compliance with the DPA 2019 attracts administrative fines of up to KES 5,000,000 or imprisonment of up to 10 years under Section 71, making a strong Privacy Policy essential for every Kenyan business.

A Privacy Policy in Kenya is required as soon as any organisation collects, stores, or processes personal data of individuals located in Kenya, regardless of the organisation's size, sector, or the volume of data processed.

A Privacy Policy is needed when a Kenyan business operates a website, mobile application, or online platform that collects user data — including names, email addresses, phone numbers, IP addresses, or cookies. The DPA 2019 and the Data Protection (General) Regulations 2021 require a privacy notice to be provided at the point of data collection. Failure to publish a compliant Privacy Policy exposes the business to investigation and fines by the Office of the Data Protection Commissioner.

A Privacy Policy is required when a company registers with the ODPC as a data controller or data processor under the Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021. The ODPC's registration process requires submission of the organisation's privacy policy as part of the application. Organisations that process data of 1,000 or more data subjects, or that process sensitive personal data, are required to register.

A Privacy Policy is needed when a Kenyan employer collects employee personal data — including biometric data for attendance systems, payroll data, and health information — which constitutes sensitive personal data under Section 2 of the DPA 2019. The employer must inform employees about how their data will be used, the lawful basis, retention periods, and rights available to them.

A Privacy Policy is required when a Kenyan business engages in email marketing or direct marketing using personal data. The DPA 2019 requires prior consent for electronic marketing communications, and the Privacy Policy must describe the marketing use and how recipients can opt out.

A Privacy Policy is essential when a Kenyan business shares customer data with third parties — payment processors, delivery companies, cloud service providers, or advertising platforms. The Privacy Policy must identify the categories of third-party recipients and the basis for sharing, including any cross-border transfers under Section 48 of the DPA 2019.

A Privacy Policy is needed before launching a health-tech, fintech, or ed-tech product in Kenya where sensitive personal data — defined under Section 2 of the DPA 2019 to include health data, financial data, biometric data, and data revealing religious or political beliefs — will be processed. Such products require a Data Protection Impact Assessment (DPIA) under Section 31 of the DPA 2019, and the Privacy Policy forms part of the DPIA documentation.

A Kenya Privacy Policy compliant with the Data Protection Act No. 24 of 2019 and the Data Protection (General) Regulations 2021 must contain the following essential elements.

Identity of the Data Controller: The full legal name of the organisation, its Business Registration Service (BRS) number or company number under the Companies Act No. 17 of 2015, physical address, email address, and the name and contact details of the designated Data Protection Officer (DPO) where one has been appointed. Section 24 of the DPA 2019 requires data controllers to publish contact details through which data subjects can exercise their rights.

Types of Personal Data Collected: A clear description of each category of personal data collected — identification data (name, ID number), contact data (email, phone), financial data (payment information, bank account details), technical data (IP address, device identifiers, cookies), and any sensitive personal data as defined in Section 2 of the DPA 2019. The policy must be specific, not generic.

Lawful Basis for Processing: For each purpose of processing, the lawful basis under Section 30 of the DPA 2019 must be stated. Where consent is the basis, the mechanism for obtaining and withdrawing consent must be explained. Where legitimate interests are relied upon, the nature of the legitimate interest and the balancing test conducted must be described.

Purposes of Processing: Each purpose for which personal data is processed must be stated with specificity — for example, order fulfilment, fraud prevention, customer service, marketing, regulatory compliance, or analytics. The DPA 2019 prohibits processing for purposes incompatible with those originally stated without obtaining fresh consent or identifying a new lawful basis.

Data Retention Periods: The period for which each category of personal data will be retained, or the criteria used to determine the retention period. Where data is retained to comply with a legal obligation — for example, the Tax Procedures Act No. 29 of 2015 requires financial records to be retained for 5 years — that legal obligation should be cited.

Data Subject Rights: A clear explanation of each right available under Section 26 of the DPA 2019 — access, rectification, erasure, objection, restriction, data portability, and rights in relation to automated decision-making — together with the procedure for submitting a request and the response timeframe (typically 30 days under the Regulations).

Third-Party Sharing and Processors: The categories of third parties with whom personal data is shared, whether as independent controllers or as data processors acting under a Data Processing Agreement (DPA) under Section 37 of the DPA 2019. Specific third-party tools used — payment gateways like Pesalink or Cellulant, analytics platforms, or CRM systems — should be disclosed.

Cross-Border Transfers: Where personal data is transferred outside Kenya, the countries or regions involved, the legal mechanism relied upon (adequacy decision, standard contractual clauses, or consent under Section 48 of the DPA 2019), and the safeguards in place must be disclosed. Cloud services hosted in the European Union, United States, or South Africa must be specifically addressed.

Security Measures: A description of the technical and organisational security measures implemented to protect personal data, including encryption, access controls, staff training, and incident response procedures. Section 41 of the DPA 2019 requires data controllers to implement appropriate security measures.

Data Breach Notification: The policy should state that in the event of a personal data breach affecting data subjects' rights and freedoms, the ODPC will be notified within 72 hours under Section 43 of the DPA 2019, and affected data subjects will be notified without undue delay.

Cookies and Tracking Technologies: Where the organisation operates a website or application, the types of cookies and tracking technologies used, their purposes, and how users can manage their cookie preferences must be disclosed in accordance with the Data Protection (General) Regulations 2021.

The forms-legal.com Kenya Privacy Policy template incorporates all elements required by the DPA 2019, the Data Protection (General) Regulations 2021, and ODPC guidance, and can be customised for any Kenyan business sector.