The Data Protection Act, 2019 touches almost everything a modern business or individual does — from a shop collecting a phone number to an AI model trained on customer records. This page is the most complete resource we publish on it: every data-subject right explained, every issue we advise on, real Kenyan case law, and a way to ask a specific question and get a real answer. Read it, then talk to counsel.
Whether you are a data subject asking what your rights are, or an organisation that has to comply with them, these are the issues we advise on most.
Access, correction, deletion and objection requests — helping data subjects exercise their rights, and helping organisations respond to them lawfully.
Assessing whether you must register as a data controller or processor, and preparing and filing the application.
Drafting the notices, policies and terms the Act requires you to give data subjects before you collect their data.
Working out which of the Act's eight lawful bases actually applies to your processing — consent is only one of them, and often not the right one.
Running the Section 31 assessment before high-risk processing begins, and preparing the ODPC consultation where the risk is genuinely high.
Containment, the 72-hour ODPC notification, and the data-subject communication the Act requires — advised on in the first hours, not after.
Structuring transfers of personal data outside Kenya so they meet the safeguards and necessity grounds in Sections 48–50.
Age-verification and parental consent mechanisms, and the narrower grounds that apply to health, biometric and other sensitive data.
Advising on profiling and automated decision-making under Section 35, and the wider legal exposure of training or deploying AI on personal data.
The contracts between controllers and processors the Act requires, and the due diligence that should sit behind them.
Monitoring, HR systems and staff records — where employer interests and employee data rights meet.
Setting retention schedules that satisfy Section 39, and defensible deletion or anonymisation once the purpose has ended.
Consent and opt-out mechanisms for direct marketing under Section 37, including commercial use of customer data.
Complaints, investigations, determinations, appeals to the High Court, and compensation claims under Section 65.
This is not the statute reproduced — it is what the statute actually means for you, section by section. For the legal text itself, see Kenya Law's consolidated Data Protection Act, Cap. 411C ↗.
Before an organisation collects your data, it must — so far as practicable — tell you why it's being collected, who else might receive it, how it's kept secure, and what happens if you don't provide it. This is set out fully in Section 29.
Any data controller or processor can be asked what personal data they hold about you, and you are entitled to see it — subject to limited exemptions in Part VII of the Act.
An organisation can only continue if it can show a compelling legitimate interest that overrides your interests, or that the processing is needed to establish or defend a legal claim.
You can have inaccurate, outdated or misleading data corrected without undue delay, and have data erased that the controller is no longer authorised to keep, or that was obtained unlawfully.
You have the right not to be subject to a decision based solely on automated processing — including AI profiling — that produces legal effects or significantly affects you, unless it's necessary for a contract, authorised by law, or based on your consent. Where it does apply, you can ask for the decision to be reconsidered by a person.
You can ask for your personal data in a structured, machine-readable format, and — where technically possible — have it sent directly to another provider. Organisations have thirty days to comply.
Where consent is the lawful basis relied on, the organisation must be able to prove you gave it freely, specifically and with full information — and you can withdraw it at any time, without affecting what was already done lawfully before you withdrew it.
If a breach creates a real risk of harm to you, the controller must notify the ODPC within 72 hours of becoming aware of it, and tell you directly in writing within a reasonable period, unless you genuinely cannot be identified.
Before starting processing likely to create a high risk to your rights, an organisation must carry out a Data Protection Impact Assessment — and consult the ODPC beforehand if that assessment shows the risk is genuinely high.
Personal data relating to a child can only be processed with consent from a parent or guardian, and organisations must build age-verification into how they collect it — proportionate to the risk involved.
Race, health, ethnicity, religion, genetic and biometric data, property details, family and marital details, and sexual orientation are all "sensitive personal data" — processed only on narrower grounds, and health data specifically only by, or under the responsibility of, a healthcare provider.
A transfer of your personal data outside Kenya needs proven safeguards in the receiving jurisdiction, or must fit a specific necessity ground — and if it's sensitive personal data, your explicit consent is required too.
"Wakili" is Swahili for lawyer. This isn't a generic chatbot — every answer below is pre-written and checked against the Data Protection Act and our own case work, so you get an accurate answer instead of a guess.
Instant, vetted answers on Kenyan data protection law
Try a question above, or type your own — for example, "can my employer read my WhatsApp messages?"
Ask Wakili gives general information on Kenyan data protection law, not legal advice on your specific situation.
Still not sure? Talk to counselWhether you're a data subject or an organisation, the process starts the same way — understanding exactly what happened.
We establish the facts: what data, what happened, and which provisions of the Act are actually engaged.
We test the legal position against the Act, the Regulations, and how the ODPC and courts have actually applied them.
You get a plain answer on your options, the realistic risk, and what we'd recommend doing next.
Where instructed, we draft, file, negotiate or represent you — through the ODPC, or before the courts.
These are real cases from our Case Digest — the holding, not just the headline.
An advocate's photograph was used to advertise a business without her consent.
The court awarded KES 1.5 million in damages.
Why it matters: Using someone's image for commercial purposes without consent is unlawful processing of personal data — and the damages can be substantial.
Read the full case note →A dispute over the High Court's jurisdiction to hear a data protection claim before the ODPC's own complaint process had run its course.
The suit was struck out for non-exhaustion of the statutory complaint mechanism.
Why it matters: The High Court's data protection jurisdiction is "staggered," not absent — go to the ODPC first, in most cases.
Read the full case note →A family business kept using a relative's KRA PIN without ongoing authorisation.
Declarations were granted against the continued, unauthorised use.
Why it matters: A PIN, ID number or other identifier is personal data too — consent to use it isn't indefinite or automatic.
Read the full case note →The ODPC had gone silent on a complaint for 90 days with no determination.
The court issued an order of mandamus compelling the ODPC to act.
Why it matters: The regulator's own statutory deadlines are enforceable — silence is not a lawful response to a complaint.
Read the full case note →Filter by category, search by name or citation, and export a proper citation for any case you need to reference.
Under Section 26, you have the right to be informed, to access your data, to object to processing, to correction, and to deletion of false or misleading data — plus further rights covered in the section above.
Where the breach creates real risk of harm, 72 hours to notify the ODPC (Section 43), and a reasonable period after that to notify you directly, unless you can't be identified.
Not always — consent is one of eight lawful bases under Section 30. Others include performing a contract with you or the organisation's legitimate interests.
Only with proven safeguards or under specific necessity grounds (Sections 48–50) — and sensitive personal data additionally needs your consent.
Whatever you have — correspondence, notices, screenshots, the ODPC complaint if one exists. We'll tell you what's still needed.
Every situation turns on facts a summary can't capture. A short conversation with counsel is the fastest way to find out where you actually stand.
Enquire Now