Kenya's Data Protection Act and Your Business Software: A Plain-Language Guide

Almost every business system handles personal data: customer names and phone numbers, M-Pesa transaction details, patient records, student information, staff files, tenant IDs. In Kenya, how that information is collected, stored and used is governed by the Data Protection Act, 2019, overseen by the Office of the Data Protection Commissioner (ODPC).

This guide explains, in plain language, what the Act means for the software your business uses or is planning to build — and the practical design decisions that make compliance easier. It is written from a software developer's perspective.

Important: this article is general information, not legal advice. Regulations and guidance are updated from time to time. For decisions about your specific obligations, consult a qualified advocate or the ODPC's published guidance.

Who the Act applies to

The Act applies to organisations that collect or process personal data about people in Kenya. It uses two key terms:

• Data controller — the organisation that decides why and how personal data is processed. If you run a school, clinic, shop or property business and keep records about people, you are usually the controller.
• Data processor — an organisation that processes personal data on the controller's behalf. A software company hosting or managing your system, an SMS provider or a cloud service may act as a processor.

Controllers and processors may also need to register with the ODPC, depending on factors such as their size and the sector they operate in. Some sectors that handle sensitive data, such as health and education, have specific registration requirements. Check the ODPC's current registration guidance to confirm whether, and how, your organisation must register.

What counts as personal data

Personal data is any information that relates to an identified or identifiable person. In everyday business software that includes:

• Names, phone numbers, email and physical addresses
• ID and passport numbers, KRA PINs
• Payment and transaction records linked to a person
• Photos, and location information
• Account usernames and activity history

The Act also defines sensitive personal data, which includes health information, as well as other categories such as biometric data, ethnic origin, family details and others listed in the Act. Sensitive data carries stricter conditions. Clinics, pharmacies, schools and HR systems should pay particular attention.

The core principles, translated for software

The Act sets out principles for processing personal data. Here is what they mean in practical, system-design terms:

• Lawful, fair and transparent. People should know what you collect and why. Your website and forms should link to a clear privacy notice.
• Collected for a specific purpose. Decide why you need each piece of data, and don't reuse it for unrelated purposes without a proper basis.
• Adequate, relevant and limited. Collect only what you need. If your enquiry form doesn't need an ID number, don't ask for it.
• Accurate and up to date. Make it easy for staff to correct records.
• Kept no longer than necessary. Decide how long each type of record is kept, and remove or anonymise data when it is no longer needed.
• Kept secure. Protect data against loss, unauthorised access and misuse.

Respecting people's rights

The Act gives individuals rights over their data, including the right to be informed about its use, to access it, to object to processing, and to have false or misleading data corrected or deleted. Your software should make these requests practical to handle:

• Can you quickly find every record about a specific customer?
• Can you export that information if they ask for it?
• Can you correct or delete records without breaking reports and history?
• Can people opt out of marketing messages easily?

If answering a simple request means searching through ten spreadsheets and three WhatsApp groups, that is a sign the data needs a proper home.

Consent and marketing messages

Where you rely on consent — for example, to send promotional SMS — the consent should be freely given, specific and informed, and people should be able to withdraw it. In software terms, this means recording when and how consent was given, and making opt-out simple. Our guide to bulk SMS in Kenya covers good practice for customer messaging, and our customer communication service is set up to support opt-outs.

Security measures to build in

The Act requires appropriate technical and organisational measures to protect personal data. For most business systems, that includes:

• Role-based access. Staff see only the data their job requires. A cashier doesn't need payroll records.
• Strong authentication. Individual accounts for every user — no shared logins — and strong passwords, with two-step verification for sensitive roles.
• Encryption. HTTPS for all traffic, and encryption of stored data where appropriate.
• Audit trails. A record of who viewed or changed sensitive records, and when.
• Backups. Regular, tested backups stored securely, so data can be recovered after a failure.
• Secure hosting. Reputable infrastructure, kept up to date with security patches.
• Removing access promptly. When staff leave, their access is removed the same day.

Data breaches

If a personal data breach creates a real risk of harm to people, the Act requires the controller to notify the Data Commissioner without delay — within 72 hours of becoming aware of it — and, in certain circumstances, to inform affected people. A processor must tell the controller promptly. Practically, this means your system and your team need to be able to detect a problem, understand what was affected and respond quickly. Audit logs and clear responsibilities make this possible.

Working with software vendors and hosting providers

When another company processes personal data for you — your developer, host, SMS provider or cloud platform — you remain responsible for choosing them carefully. Put a written agreement in place that covers what they may do with the data, how it is secured, how breaches are reported and what happens at the end of the contract. Ask where data is stored: the Act places conditions on transferring personal data outside Kenya, so it is worth confirming how your providers handle this.

Our guide to choosing a software development company includes questions to ask about data handling.

Data protection impact assessments

Where processing is likely to create a high risk to people's rights — for example, large-scale processing of health data, or new technologies used for monitoring — the Act requires a data protection impact assessment (DPIA) before processing begins. A DPIA describes the processing, assesses the risks and sets out the measures to reduce them. For a new system that handles sensitive data, it is far easier to do this at the design stage than after launch.

A practical checklist for your systems

1. List the systems, spreadsheets and apps that hold personal data.
2. For each, note what data is held, why, who can access it and how long it is kept.
3. Remove fields and records you don't need.
4. Publish a clear privacy notice and link to it from your forms.
5. Give each user an individual account and the minimum access they need.
6. Make sure your website and systems use HTTPS.
7. Set up regular, tested backups.
8. Agree data handling terms with your software and hosting providers.
9. Check whether you need to register with the ODPC.
10. Decide who handles data requests and breaches, and write it down.

Building data protection into new software

The Act encourages data protection by design and by default — thinking about privacy from the beginning rather than adding it later. When we plan a new system with a client, we consider which data is truly needed, who should see it, how long it should be kept and how requests will be handled, alongside the features themselves. It costs far less than retrofitting a finished system.

If you're planning a system that handles customer, patient, student or staff data, our custom software development and IT consulting teams can help you plan it properly. Book a free consultation to talk it through — and remember to involve your legal adviser for questions about your specific obligations.