The fines
Section 63 of the Data Protection Act, 2019 lets the Data Commissioner impose an administrative fine of up to KES 5 million, or 1% of the organisation's annual turnover in the preceding financial year, whichever is lower. Separate offences in the Act carry fines and imprisonment on conviction.
How enforcement works
- A complaint or the Commissioner's own investigation identifies a possible breach
- An enforcement notice sets out the failure and the steps required, with a deadline
- Failure to comply leads to a penalty notice and an administrative fine
- The organisation can appeal to the High Court
Most published ODPC determinations come from complaints. Digital lenders contacting borrowers' friends and family, schools and businesses posting people's images without consent, and unsolicited marketing have all led to fines. The common thread is processing without a lawful basis, and no record showing what the basis was.
What reduces your exposure
The Commissioner looks at what you had in place when things went wrong. A documented lawful basis for each processing activity, a current registration, a DPIA for high-risk processing and a breach handled on time all count in your favour.
Compensation is separate: under section 65 a person who suffers damage because of a contravention is entitled to compensation from the controller or processor, so a fine is not the only cost.
hlola's Regulator Readiness card shows the gaps an ODPC inspector would find first, weighted by importance, so you fix the ones that carry the most risk.
Common questions
What is the maximum fine under Kenya's Data Protection Act?
Up to KES 5 million or 1% of annual turnover in the preceding financial year, whichever is lower, under section 63.
Has the ODPC actually fined organisations?
Yes. The ODPC has issued penalty notices against businesses including digital lenders, schools and hospitality businesses, mostly for processing personal data without a lawful basis.
Can individuals claim compensation?
Yes. Section 65 entitles a person who suffers damage from a contravention of the Act to compensation.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.