At Kathurima N Advocates, we help businesses and organizations across Kenya comply with the Data Protection Act, 2019, from ODPC registration and privacy policy drafting to breach response and cross border data transfers, so that data protection becomes a source of trust with your customers and investors, not a standing legal risk hanging over your operations. Whether you are a growing SME handling your first customer database or a multinational managing data across several jurisdictions, our data protection and privacy law practice gives you the specialized guidance this fast moving area of law demands.
Kenya's data protection framework is no longer a new or optional consideration for businesses, it is an actively enforced legal obligation. The Data Protection Act, 2019 gives detailed effect to the right to privacy guaranteed under Article 31 of the Constitution of Kenya, 2010, and is enforced by the Office of the Data Protection Commissioner, headquartered at Britam Towers in Upper Hill, Nairobi. The ODPC has moved well beyond its early awareness building phase, issuing a steady stream of enforcement notices, penalty notices, and compensation orders against organizations across banking, telecommunications, media, retail, and digital platforms since the Act came into force.
Noncompliance carries real financial exposure. Administrative fines under the Act can reach up to five million Kenyan Shillings or one percent of an organization's annual turnover for the preceding financial year, whichever is lower, while certain offences, including unlawful disclosure of personal data and failure to register where required, carry criminal penalties of up to three million shillings, imprisonment of up to ten years, or both. Beyond the direct financial risk, a mishandled data protection matter causes lasting damage to customer trust and investor confidence, both of which are far more expensive to rebuild than they are to protect in the first place.
ODPC Registration. We assess whether your organization meets the registration thresholds as a data controller, a data processor, or both, and manage the entire registration process through the ODPC portal, from preparing a complete, accurate application to following up with the regulator to ensure a smooth approval.
Privacy Policies, Notices, and Consent Frameworks. We draft and review privacy policies, data protection policies, and consent mechanisms tailored to your organization's actual data processing activities, not generic templates copied from an unrelated jurisdiction, ensuring they meet the Act's requirements for lawfulness, fairness, and transparency.
Data Protection Impact Assessments (DPIAs). Where your processing activities are likely to pose a high risk to individuals, large scale processing of sensitive personal data, new technologies such as AI driven analytics, or automated decision making, we conduct and document DPIAs that meet ODPC expectations and demonstrate genuine accountability.
Data Breach Response. We help organizations prepare breach response protocols in advance, and when an incident occurs, we move quickly to assess the breach, prepare a compliant notification to the ODPC within the mandatory seventy two hour window, notify affected individuals where required, and represent you through any resulting ODPC inquiry.
Cross Border Data Transfers and GDPR Alignment. For businesses transferring personal data outside Kenya, whether to a parent company, a cloud provider, or international clients, we structure transfers around Section 48 of the Act's requirements, appropriate safeguards, necessity, or consent, while ensuring alignment with GDPR where your organization also has European exposure.
Compliance Audits. We conduct comprehensive reviews of your organization's data handling practices, assessing risk across collection, storage, processing, and third party sharing, and deliver a clear, prioritized roadmap to close any gaps identified.
Outsourced Data Protection Officer Services. For organizations required to appoint a DPO, or that want dedicated compliance oversight without hiring in house, we provide outsourced DPO services covering ongoing compliance monitoring, staff training, and acting as your organization's point of contact with the ODPC.
ODPC Investigation and Enforcement Representation. Where your organization faces a complaint, an enforcement notice, or a full ODPC investigation, we represent you directly before the Commissioner, and through any subsequent review or High Court appeal, working to resolve the matter efficiently and limit regulatory exposure.
Staff Training. We equip your team with practical, working knowledge of data protection obligations relevant to their specific roles, since most compliance failures originate from everyday staff decisions rather than deliberate wrongdoing.
Our data protection practice supports a wide range of organizations across Kenya's economy, including fintech and financial services companies managing sensitive financial data, healthcare providers handling patient records, ecommerce and retail businesses processing customer and payment data, HR and recruitment firms managing employee and candidate information, foreign subsidiaries and multinationals needing dual compliance with Kenyan law and international frameworks like GDPR, and SMEs building their first genuine compliance program as they grow. Whatever your sector, we tailor our advice to the actual data you handle and the actual risks your organization faces, rather than a one size fits all compliance checklist.
Genuine dual expertise. We advise on both Kenya's Data Protection Act and international frameworks like GDPR, which matters considerably for any business with cross border operations or customers, ensuring your compliance program holds up on both sides of the relationship rather than leaving gaps a Kenya only or GDPR only approach would miss.
Hands on regulatory experience. Our guidance is grounded in real, practical experience with ODPC registration, breach notification, and enforcement matters, not just familiarity with the statute's text.
Available when it matters. Data protection deadlines do not wait for business hours, a breach discovered on a weekend still carries a seventy two hour notification clock. We offer free consultations available twenty four hours a day, seven days a week, so you are never left waiting for standard office hours when a matter is genuinely urgent.
Practical, business focused advice. We build compliance programs designed to actually work within how your organization operates day to day, not theoretical frameworks that look good on paper but create friction in practice.
Does my business need to register with the ODPC? Generally, registration is required if your organization has an annual turnover above five million Kenyan Shillings and more than ten employees, meeting either threshold alone can trigger the requirement. Certain categories, including financial services, healthcare, and organizations processing sensitive personal data at scale, must register regardless of size.
What happens if my business experiences a data breach? You are required to notify the ODPC without undue delay, and in any case within seventy two hours of becoming aware of the breach. Where the breach poses a high risk to affected individuals, they must also be notified directly. We help organizations meet this deadline and manage the full response.
Do I need a Data Protection Officer? Certain organizations, particularly those processing sensitive personal data at scale or as a core part of their business, are required to appoint a DPO. We can assess whether this applies to your organization and provide outsourced DPO services if needed.
How does GDPR affect my Kenyan business? If you have customers, users, or employees located in the European Union, GDPR can apply to your business even without a physical presence there. We help businesses build compliance programs that satisfy both Kenyan and GDPR requirements simultaneously.
What are the penalties for noncompliance? Administrative fines can reach up to five million Kenyan Shillings or one percent of annual turnover, whichever is lower, and certain offences carry criminal penalties including imprisonment of up to ten years.
How long does ODPC registration take? For a complete, properly prepared application, the ODPC generally issues a certificate of registration within about fourteen days.
Data protection compliance is not a box to check once and forget, it is an ongoing responsibility that touches nearly every part of how a modern business operates. Let our data protection and privacy law team build a compliance program that protects your business, your customers, and your reputation.
