Introduction
Data is the currency of today’s economy. For Kenyan SMEs, customer contacts, employee records, and payment details are critical for daily operations. But with this opportunity comes responsibility. The Data Protection Act (DPA) 2019 requires businesses to collect, process, and store data responsibly.
Non-compliance is costly. Penalties can reach KES 5 million or 1% of annual turnover, whichever is higher. Beyond fines, businesses risk reputational damage and loss of customer trust. On the positive side, compliance enhances brand credibility, builds loyalty, and opens doors to investors who value strong governance.
This article provides a step-by-step Kenya data protection compliance checklist designed for SMEs. It simplifies DPA 2019 obligations and shows practical actions you can implement, even with limited resources.
Understanding DPA 2019 Obligations
Overview of the Data Protection Act 2019
The Data Protection Act (DPA) 2019 aligns Kenya with international privacy laws such as the EU’s GDPR. It applies to any business—large or small—that collects or processes personal data belonging to people in Kenya.
The law is anchored on key principles:
- Transparency – individuals must know how their data is used.
- Purpose limitation – collect data for specific, lawful purposes only.
- Data minimization – only gather what you really need.
- Accuracy – keep records up to date.
- Storage limitation – don’t keep data longer than necessary.
- Confidentiality and integrity – safeguard data from breaches and unauthorized access.
Two roles are recognized under the Act:
- Data Controllers – decide how and why personal data is processed.
- Data Processors – handle data on behalf of controllers.
In reality, most SMEs in Kenya play both roles. For instance, a salon storing customer phone numbers for promotions is a controller, but if it uses an email marketing tool, it also acts as a processor.
Oversight rests with the Office of the Data Protection Commissioner (ODPC), which monitors compliance, registers businesses, and enforces penalties.
Registration Requirements with the ODPC
Registration with the ODPC is mandatory for many SMEs. Businesses that handle sensitive or large volumes of personal data must register. Common examples include:
- Financial services (banks, SACCOs, microfinance)
- Healthcare providers (clinics, hospitals, pharmacies)
- Educational institutions (schools, colleges, training centers)
- E-commerce and digital platforms
- Marketing and advertising agencies
The process is simple:
- Apply via the ODPC online portal.
- Provide details on your business, the type of data collected, and security measures in place.
- Pay the applicable fee (KES 1,000 – 40,000 depending on sector and business size).
Once approved, you receive a certificate valid for one year. Renewal is mandatory. Displaying this certificate reassures customers that your business values privacy.
Failure to register, when required, can trigger investigations, fines, and even suspension of data operations.
Penalties for Non-Compliance
The DPA 2019 is strict. Businesses that ignore it face consequences that go beyond financial losses.
Legal penalties include:
- Fines of up to KES 5 million or 1% of annual turnover.
- Civil liability—individuals can sue for damages.
- Criminal sanctions in cases of deliberate misuse.
Business risks include:
- Loss of trust and customer loyalty.
- Reputational damage amplified by social media.
- Disruption of operations through ODPC investigations.
Recent enforcement actions, like the ODPC’s move against Worldcoin in 2023, prove that regulators are serious. Even though SMEs may not operate at that scale, the lesson is clear: compliance is not optional.
Adopting compliance early helps SMEs build trust and remain competitive in an increasingly digital economy.
Step-by-Step Compliance Actions
Consent Management
Consent is the foundation of data protection. SMEs must ensure customers know what they’re agreeing to before sharing their data.
Best practices for consent include:
- Be transparent – explain why data is needed (e.g., “We collect your phone number to confirm delivery”).
- Use clear language – avoid technical jargon.
- Don’t bundle consent – marketing consent should be separate from service consent.
- Allow easy withdrawal – customers should be able to opt out at any time.
- Keep records – document when and how consent was given.
For example, an online clothing shop should let customers tick a box if they want promotional emails. Pre-ticked boxes or silent assumptions do not qualify as consent.
Equally important is respecting withdrawals. If a customer unsubscribes, you must immediately stop sending marketing messages. Ignoring this exposes your business to complaints and possible ODPC penalties.