East Africa / Kenya
AvailableKenya's privacy framework. Connected to your programme.
Kenya Data Protection Act, 2019
Turn local requirements into assigned work, linked records and evidence you can review.
Kenya · in hlola
The framework at a glance.
Kenya's comprehensive data protection law, enforced by the Office of the Data Protection Commissioner.
- Country
- Kenya
- Primary legislation
- Kenya Data Protection Act, 2019
- Statutory clocks
- Breach notice 72 hours · rights requests 7 days
Key areas
From requirements to practical work.
- Governance2 controls to evidence
- Principles1 control to evidence
- Records1 control to evidence
- Transparency1 control to evidence
- Lawfulness1 control to evidence
- Rights1 control to evidence
- Risk1 control to evidence
- Special categories2 controls to evidence
- Retention1 control to evidence
- Security1 control to evidence
- Incidents1 control to evidence
- Transfers1 control to evidence
- Third parties1 control to evidence
See how the work connects.
Move from a requirement to the record, owner and evidence behind it.
Explore platform featuresStatuses support programme review; they are not legal certification.Illustrative records
What an inspector checks
15 controls, mapped to the Act.
KEN-001 · Section 18
Register with the Data Commissioner
Data controllers and processors that meet the registration thresholds must register with the ODPC and keep the registration current.
KEN-002 · Section 24
Designate a Data Protection Officer
Designate a DPO where required, publish their contact details and give them the resources to perform the role.
KEN-003 · Section 25
Apply the data protection principles
Process personal data lawfully, fairly and transparently, for explicit purposes, minimised, accurate, retained no longer than necessary and kept secure.
Three are shown here; the full set, with tasks and evidence guidance, is in hlola.Pending review by counsel.
Bring Kenya into your privacy programme.
See your readiness against Kenya DPA in a demo set up for your organisation.