The next phase of privacy in Kenya

The data protection and privacy landscape has evolved exponentially in the last six years since the inception of the Kenya Data Protection Act Cap 411C (Laws of Kenya) in 2019. As Kenya enters a new enforcement phase in 2026, organizations should expect more structured regulatory scrutiny, maturing audit practices, and increased accountability for data governance and privacy failures.

This shift reflects a broader continental movement toward a harmonized data protection standard. We have seen a huge shift in public awareness and national sensitization training delivered by the Office of the Data Protection Commissioner (ODPC), to the growth in the number of individuals lodging complaints directly with the ODPC for violation of their constitutional right to privacy.

Enforcement and awareness alone are no longer sufficient. Kenya’s rapid transition into real-time, interconnected, and AI‑driven economy and operating across borders has introduced privacy and trust complexities beyond the early Data Protection Act vision. As we move into the latter half of the decade, organizations must reinvent their approach to data governance and build an AI-era trust architecture grounded in interoperable standards, transparency, accountability, fairness, secure operations, and continuous assurance amid evolving cyber risks. 

From a regulatory perspective, this shift toward enforcement is evident in the growing publication of sector agnostic and sector specific guidelines targeting sectors that collect and process large volumes of personal data. The education sector has emerged as a priority given its handling of children data and the scale of personal data processed by schools, government agencies, and research organizations with particular emphasis on parental consent, identity verification, and auditable consent mechanisms.

The Regulator has similarly issued guidance for the healthcare sector and the draft private security guidelines underscoring the need for stronger internal data governance controls, staff training, and accountability in handling sensitive data. In healthcare, specific attention is placed on safeguarding personal health information, clarifying legal and ethical obligations, and distinguishing between medical consent and consent as a lawful basis for processing personal data.

These guidelines signal a clear move from awareness‑raising to practical, enforceable expectations that require organizations to embed privacy, security, and assurance into their day‑to‑day operations. More recently, an emerging draft regulatory framework suggests an even more mature enforcement phase ahead. Over a year ago, the ODPC published the proposed Data Protection Compliance Audit Regulations 2024 as well as the Conduct of Compliance Audit Regulations 2024 (the Regulations) which establishes a framework for the conduct of data protection audits.

Businesses operating in Kenya as data controllers or data processors should be aware of the key triggers that can lead to the initiation of a data protection audit. Audits may follow individual complaints, regulatory investigation or enforcement; risk assessment indicating a non-compliance, data breach notification or direct ODPC initiation. To prepare for the forthcoming ODPC led audit regime, businesses should conduct internal compliance readiness checks and strengthen controls.

This includes developing and maintaining comprehensive Records of Processing Activities (ROPAs), conducting internal data privacy controls reviews including security controls, incident response testing, and the organization’s cybersecurity posture, deploying robust, technology-driven Data Subject Access Request (DSAR) workflows that are scalable and easy to optimize, reviewing data processing agreements with third-party vendors to ensure compliance alignment and documenting lawful bases for all processing activities, particularly consent-driven processing, using automated consent management to improve transparency and customer experience.

To strengthen regional alignment on data protection governance, the ODPC has initiated stakeholder consultations on Kenya’s potential accession to the African Union Convention on Cyber Security and Personal Data Protection, commonly referred to as the Malabo Convention. This move signals Kenya’s intent to play a more active role in advancing safer, more secure and trusted digital environment. Accession is expected to bring Kenya closer to bilateral or multilateral agreements with other AU member states particularly in easing the regulatory requirements for cross border data transfers.

As Kenya moves closer to alignment with African Union–level data protection standards, organizations should proactively map cross‑border data flows, assess transfer mechanisms, and prepare for AU‑compliant safeguards. Early engagement with cloud service providers and regional partners will be critical to ensure smooth transitions as Convention obligations take effect.

At the same time, Kenya’s shift into a more assertive enforcement era requires businesses to move beyond reactive compliance toward deliberately building trust architectures. Embedding strong controls and aligning with regional and global frameworks will be essential to building confidence, protecting brand integrity, and unlocking long‑term business value in 2026 and beyond.