0722 878 607 [email protected]
Pinetree Plaza, Nairobi
MP Muchangi Patrick& Associates Advocates
Talk to an Expert
Practice Areas Case Digest Knowledge Centre Insights About Contact Talk to an Expert
01Compliance ToolsCheck, assess and act 02Case DigestKenyan decisions & ODPC determinations 03PublicationsPractice Notes & legal analysis 04Practice AreasData, technology, regulatory & disputes 05Compliance CheckerA practical readiness assessment
DATA PROTECTION & PRIVACY LAW · KENYA

Data protection.
Understood. Applied.

Legal counsel, regulatory intelligence and practical compliance for organisations operating with personal data in Kenya.

Explore Case Digests & More View Our Practice Areas
KENYA DATA PROTECTION & PRIVACY JURISPRUDENCE

The Case Digest.

33 case notes, searchable by name, citation or keyword — plus the official downloadable volumes.

[2026] KEHC 5928

An advocate's image used to advertise a business without consent draws Kshs 1.5 million in damages

Kipchirchir v Hornbill Rongai Limited

Read the case note →
[2026] KEHC 8819

The High Court's data protection jurisdiction is "staggered," not absent

Mwaniki v Safaricom PLC

Read the case note →
[2026] KEHC 5690

Kenya's courts decline a blanket AI moratorium, but order the government to report back

Wangai & 2 Others v Cabinet Secretary

Read the case note →
Browse All 33 Cases

Official Volumes

Downloadable PDF editions
KPLR Volume I — Consent, Data Protection and Digital Rights
VOLUME I – MASTER EDITIONConsent, Data Protection & Digital Rights40-case master publication
Kenya Data Protection Law Case Digest
KENYA DATA PROTECTION LAW CASE DIGESTSystematic compilation of Kenyan data protection decisions58 decisions
Grain Industries Limited v E.M. and ODPC case digest
KPLR 001 – GRAIN INDUSTRIES LTD V E.M. & ODPCCivil Appeal E167 of 2024 (Murang'a)Kenya data protection jurisprudence
Mind Quest Limited v M. and 2 Others case digest
KPLR 003 – MIND QUEST LIMITED V M. & 2 OTHERSImage rights & modelling consent disputeCase Digest Series 001
Expertise that can be acted on

Read the authority. Then get the legal advice.

Our case digests and Knowledge Centre explain the law. Our legal services help you apply it to the problem in front of you.

Talk to an Expert
Kenya Privacy Law Review

Practice Notes.

Focused analysis of the questions that sit between the statute, the regulator and the way organisations actually operate.

Practice Note: The Architecture of Lawful Processing
PN 001 · Constitutional Law

The Architecture of Lawful Processing

 Practice Note: Employee Monitoring
PN 002 · Employment

Employee Monitoring

 Practice Note: Cross-Border Data Transfers PN 003 · Cross-BorderCross-Border Data Transfers Practice Note: Artificial Intelligence Procurement PN 004 · Artificial IntelligenceArtificial Intelligence Procurement Practice Note: Privacy by Design PN 005 · Systems & Product DesignPrivacy by Design
Explore the Knowledge Centre →
Practical Compliance

Check your position.

Answer a focused set of questions against Kenya's data protection requirements and receive a structured readiness assessment.

52legal controls
5sector tracks
10 mintypical completion
Instantreadiness report
More from the Knowledge Centre

Recent thinking.

Legal and regulatory developments worth having on your desk.

Regulatory Analysis · 001The Future of Digital Trust Governance in Kenya Regulatory AnalysisKenya's Data Protection Officer Framework Bills ReviewWhat Kenya's AI Bill means for business Legal InsightThe website-blocking power now on trial
Common Questions

Data protection law in Kenya, answered plainly.

Do I need a data protection lawyer in Kenya?

Any organisation that collects, stores or processes personal data in Kenya — whether a bank, a hospital, a SACCO, a school, a startup or a government office — is a data controller or processor under the Data Protection Act, 2019, and carries legal obligations regardless of size. A data protection lawyer helps you register with the ODPC where required, draft compliant privacy notices and contracts, respond to data-subject requests, and manage the exposure of a breach before it becomes a regulatory problem. See our full data protection & privacy practice.

What does the Office of the Data Protection Commissioner (ODPC) do?

The ODPC is Kenya's data protection regulator under the Data Protection Act, 2019. It registers data controllers and processors, investigates complaints from data subjects, issues enforcement notices and penalties, and publishes guidance on how the Act applies to specific sectors and emerging technologies, including AI. We track ODPC decisions directly in our Case Digest library.

Is ODPC registration mandatory for my business?

Registration is mandatory for controllers and processors that meet the thresholds in the Data Protection (General) Regulations, 2021 — broadly, larger organisations, those handling sensitive personal data, and certain sectors regardless of size. Even where registration isn't mandatory, the Act's substantive obligations still apply. Run our free ODPC Compliance Checklist or see the full registration service for current fees and timelines.

What should I do if my business has a data breach?

The Data Protection Act, 2019 requires controllers to notify the ODPC of a breach likely to pose a risk to data subjects, and in some cases to notify the affected individuals directly, within a short statutory window. How you respond in the first hours materially affects your legal exposure. See our breach response & cybersecurity service.

How is this firm different from other Kenyan law firms?

We publish our legal work rather than keep it behind a client portal. The Case Digest holds 33 searchable notes on Kenyan data protection decisions, the Knowledge Centre publishes practice notes on live compliance questions, and the regulatory changelog tracks what we've published as it happens. Most firms describe their expertise; we show it.

Where are you based, and do you work with clients outside Nairobi?

We're based in Nairobi, Kenya, and act for clients across the country and abroad on Kenyan data protection and technology law matters — most engagements run entirely remotely by video call and email. Get in touch to discuss your matter.

When you need counsel

Bring us the legal question.

For advice, compliance support, regulatory strategy or representation, speak directly with an advocate.

Talk to an Expert

For essential site functionality and to remember your preferences, we use a small number of cookies. With your consent, we also use cookies to understand how visitors use this site. For more information, see our Cookie Notice.