After a series of false starts, Kenya has finally enacted a fully-fledged data privacy and protection law, the Data Protection Act of 2019 (the DPA). 

The President of Kenya assented to this crucial legislation on 8 November 2019, which is now awaiting publication in the Kenya Gazette. Under Kenya’s Constitution, a bill passed by Parliament and assented to by the President must be published in the Gazette within seven days of the assent. 

The DPA gives effect to Articles 31(c) and (d) of the Constitution of Kenya which guarantee the right of every person not to have “information relating to their family or private affairs unnecessarily required or revealed” and the right not to have “the privacy of their communications infringed”. 

The DPA establishes the office of a Data Protection Commissioner, which will oversee the implementation of and be responsible for the enforcement of the legislation. The statute adopts global data protection principles (such as those contained in EU’s GDPR) on the basis of which personal data is to be collected, processed, stored and/or transferred. The new legislation also sets out the rights of data subjects and obligations of data controllers, data processors and third parties who handle personal data. Overall, the DPA will usher in a robust legal and institutional mechanism for the protection of personal data, will have far-reaching implications on how personal data is handled and introduces stiff penalties for breach of its provisions.

We will provide a more detailed analysis of the legislation once it is published in the Gazette.

The content of the above publication is for general information only and is not intended to be in the nature of legal advice. Information contained in this publication should not be acted upon in any specific situation without appropriate legal advice. Dentons Hamilton Harrison & Mathews does not accept responsibility or liability to users or any third parties in relation to use of this publication or its contents. All copyright, trademarks and other intellectual property in or arising out of the publication vest solely in Dentons Hamilton Harrison & Mathews.