If your website collects any personal information, through a contact form, a newsletter signup, an online order, or even just analytics cookies, you need a privacy policy page and, in most cases, a cookie consent notice. This isn't just good practice: Kenya's Data Protection Act, 2019 requires businesses that collect or process personal data to be transparent about how they use it.
Why Your Website Needs This
Under the Data Protection Act, anyone visiting your site and submitting their name, email, phone number, or payment details is entitled to know what happens to that information. A clear privacy policy protects you as much as it protects your visitors: it sets expectations and reduces disputes if a customer ever asks how their data is used.
If your business collects personal data at any meaningful scale, check whether you need to register as a data controller or data processor with Kenya's Office of the Data Protection Commissioner (ODPC). A privacy policy on your site does not replace this registration where it applies.
What to Include in Your Privacy Policy
Keep the language simple and specific to your own site. At minimum, cover:
- What personal data you collect (names, emails, phone numbers, MPesa transaction details, IP addresses, etc.)
- How you collect it (contact forms, checkout pages, cookies, account registration)
- Why you collect it and how you use it
- Any third-party tools that receive visitor data, such as Google Analytics, email marketing tools, or payment gateways
- How long you keep the data and how visitors can request access, correction, or deletion
- Your business contact details for privacy-related questions
Adding a Cookie Consent Notice
If your website sets cookies for anything beyond making the site function, such as Google Analytics, embedded YouTube videos, or advertising pixels, visitors should be told and given the option to accept or decline before those cookies load. A simple banner at the bottom or top of the page that links to your privacy policy is usually enough for a small business site.
In WordPress
- Create a new page in your dashboard: go to Pages, then Add New, title it "Privacy Policy," and paste in your policy content.
- Publish the page and add it to your site's footer menu so it's visible from every page.
- Install a cookie consent plugin from the WordPress Plugin Directory (search "cookie consent" under Plugins, then Add New). Most let you customize the banner text and link it directly to your Privacy Policy page.
- Activate the plugin and configure it to block analytics or advertising scripts until a visitor accepts.
On a Custom-Built Website
- Add your privacy policy as a standalone HTML page (for example, privacy-policy.html) and link to it from your site's footer.
- Add a small cookie banner using a lightweight JavaScript snippet that displays on first visit, stores the visitor's choice in their browser, and only loads analytics or tracking scripts after they accept.
- If you use Google Analytics or similar tools, wrap the tracking code so it only runs after consent is given, rather than loading automatically on page load.
Once your privacy policy and cookie notice are live, review them whenever you add a new tool or service to your site, such as a new payment method or marketing pixel, since your policy should always reflect what your site actually does.
For a broader checklist of what else your site needs before it goes live, see What Every Small Business Website Needs Before Launch.