Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Kenya's Data Protection Act, 2019 requires notification of the Data Commissioner within 72 hours of becoming aware of a breach, and caps administrative fines at KES 5,000,000 or 1% of annual turnover, whichever is lower.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
Kenya's principal data protection statute (Cap. 411C, Laws of Kenya), giving effect to Article 31(c) and (d) of the Constitution. Establishes the Office of the Data Protection Commissioner, regulates processing of personal data, and sets out data subject rights and controller/processor obligations, including breach notification (Section 43) and administrative fines (Section 63).
Source72 hours
Under Section 43(1)(a), a data controller must notify the Data Commissioner without delay and in any event within 72 hours of becoming aware of a breach. If notification is delayed beyond 72 hours, the notification must explain the reason for the delay.
Notify: Office of the Data Protection Commissioner (ODPC)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
Data Protection Act, 2019, Administrative Fine (Section 63)
Up to KES 5,000,000, or 1% of the undertaking's annual turnover for the preceding financial year, whichever is lower
Some legal commentary references a pending amendment bill that would flip this to 'whichever is higher', not independently verified as enacted, so treat the current 'whichever is lower' figure as the confirmed one and check for updates before relying on it long-term.
SourceNot applicable , as of 2026-09-08
Within 72 hours of becoming aware of the breach, under Section 43(1)(a) of the Data Protection Act, 2019. If the 72-hour deadline is missed, the notification must explain the reason for the delay.
Under Section 63, up to KES 5,000,000, or 1% of the entity's annual turnover for the preceding financial year, whichever figure is lower.
The Office of the Data Protection Commissioner (ODPC), established under the Data Protection Act, 2019 to implement and enforce the Act.
Talk to us about scoping an engagement around your specific regulatory context.
