Kenya's Data Protection Act, 2019 applies to any business that collects or processes personal data, and that includes customer names, phone numbers, email addresses, staff records and CCTV footage. The regulator is the Office of the Data Protection Commissioner (ODPC).
This is a practical starting checklist, not legal advice. For anything specific, speak to a lawyer.
1. Know what data you hold
List what personal data you collect, why you collect it, where it is stored and who can access it. You cannot protect what you have not mapped.
2. Register if required
Data controllers and processors must register with the ODPC unless exempt. Check the ODPC website to see whether your business must register and what the fee is for your size.
3. Have a lawful reason and, where needed, consent
Only collect data for a clear purpose. Where you rely on consent, it must be freely given, specific and easy to withdraw. Pre-ticked boxes do not count.
4. Publish a privacy notice
Tell people what you collect, why, who you share it with, how long you keep it and how to exercise their rights. Put it on your website and your forms.
5. Secure the data
- Use strong, unique passwords and multi-factor authentication.
- Encrypt laptops, phones and backups.
- Keep systems patched and limit who can see what.
- Serve your website over HTTPS (check it with our SSL analyzer).
6. Respect people's rights
Customers can ask to see, correct or delete their data. Decide in advance who handles these requests and how quickly.
7. Prepare for a breach
Have a written plan: who investigates, who decides, and how you notify the ODPC and affected people within the legal timeframe. Practise it once.
8. Be careful with vendors and transfers abroad
If a supplier handles your customer data, have a contract that covers security. Sending data outside Kenya has extra conditions, so check before you adopt a foreign cloud tool.
Where Quepath can help
We run security assessments, harden websites and systems, and help teams build processes that stand up to an audit. Contact us to talk it through.