Two years of Kenya's Data Protection Act. Enforcement lessons for global operators

Kenya's Data Protection Act and the Office of the Data Protection Commissioner have moved from awareness to enforcement. Published decisions and guidance emphasise lawful basis, transparency to data subjects, security of processing, and the duty to notify breaches within the statutory window.

Organisations that treat registration with the ODPC as the end of compliance are exposed. Registration is a starting point. The operational questions are whether processing is mapped, whether consent or another lawful basis is documented, and whether security measures are proportionate to the risk.

Complete or refresh a processing inventory that covers systems, vendors and cross-border transfers. Many mid-market organisations still cannot answer where personal data actually lives.

Review vendor contracts for data protection clauses and transfer mechanisms. Cloud and SaaS providers are in scope even when the brand is international.

Test breach detection and notification playbooks against the Act's timelines. A tabletop exercise is cheaper than a late notification finding.

Align privacy work with ISO 27001 or equivalent security controls. Security of processing is both a legal duty and a certification requirement for many of our clients.

Global operators often underestimate local registration and guidance while over-indexing on EU GDPR templates. Kenya-specific notices, retention and subject access processes are still required.

Conversely, a strong ISO 27001 or SOC 2 programme is useful evidence of security of processing, but it does not replace the accountability and transparency duties under the Act.

We help organisations map processing, close ODPC registration and policy gaps, and integrate data protection with ISO 27001 and broader compliance retainers. Delivery is practical and evidence-led, onsite in Nairobi or remote for regional and international groups.