Kenya's Data Protection Act, 2019 sets out rules for any business that collects personal information from people in Kenya, and that includes most websites with a contact form, a newsletter signup, an online store, or a login area. If your website collects names, emails, phone numbers, M-Pesa transaction details, or any other data that identifies a person, the Act applies to you.
Who the Act Applies To
The law covers anyone who collects or processes personal data from people in Kenya, regardless of where your business is based. In practice, this means almost every website that has one of the following:
- A contact or inquiry form
- An online store or checkout page
- A newsletter or email signup
- A customer login or account area
- Website analytics or advertising tracking, such as Google Analytics
What the Law Expects From Your Website
You don't need a legal team to meet the basics. Most of what's required is good practice that any legitimate business should already follow:
- Tell visitors what data you collect and why, usually through a privacy policy.
- Get clear consent before collecting non-essential data, such as marketing emails or tracking cookies.
- Only collect the data you actually need for the stated purpose.
- Keep the data secure, for example by using HTTPS and keeping your website software updated.
- Give people a way to ask what data you hold on them, correct it, or have it deleted.
Steps to Make Your Website Compliant
- Add a privacy policy page that explains what data you collect, why, how long you keep it, and who to contact with questions.
- Add a cookie consent notice if your site uses tracking cookies or third-party scripts like analytics or ad pixels.
- Install an SSL certificate so data submitted through your forms is encrypted in transit.
- Review every form on your site and remove any field you don't genuinely need. For example, don't ask for a national ID number if you'll never use it.
- Set up a dedicated email address, such as [email protected], for data access or deletion requests.
If you run an online store or regularly handle sensitive data such as ID numbers, health information, or financial details, get advice from a lawyer familiar with Kenyan data protection law. This article covers the general basics, not a full legal compliance review.
Do You Need to Register with the ODPC?
Kenya's Office of the Data Protection Commissioner (ODPC) requires certain data controllers and processors to register, based on factors like annual turnover and the volume or sensitivity of data handled. Small businesses below the set thresholds may be exempt, but the thresholds change from time to time, so check the ODPC's current guidance or ask your accountant or legal advisor whether your business needs to register.
Once your privacy policy and cookie consent notice are in place, see how to add a privacy policy and cookie consent notice to your website for the practical setup steps.