Kenya's Data Protection Act and your website: a practical checklist

Every contact form, newsletter sign-up, M-Pesa checkout and member portal collects personal data. In Kenya, that brings your website under the Data Protection Act, 2019 — whether you are a large company or a small shop. The good news is that most of what the law asks for is good practice that also builds customer trust. This checklist explains what it means for your website in plain language.

What is the Data Protection Act, 2019?

The Act protects people's personal data and sets rules for anyone who collects or uses it. It created the Office of the Data Protection Commissioner (ODPC), which registers organisations, handles complaints, investigates and can fine those who break the rules.

Two terms you will see often:

• Data controller — the organisation that decides why and how personal data is used. For your website, that is you.
• Data processor — a company that handles data on your behalf, such as your hosting company, email provider or SMS provider.

What counts as personal data on a website?

The principles in plain language

• Be open — tell people what you collect, why, and who you share it with.
• Collect only what you need — a quote form rarely needs an ID number or date of birth.
• Use it only for the stated purpose — data from a quote request should not quietly become a marketing list.
• Keep it accurate and not forever — delete old enquiries and inactive accounts on a schedule.
• Keep it secure — HTTPS, strong passwords, limited access, backups and updates.
• Be careful sending it abroad — many hosting and email services store data outside Kenya; make sure they have proper safeguards.

The website checklist

1. Publish a privacy policy that names your organisation, lists the data you collect, explains why, who you share it with (hosting, SMS, payment providers), how long you keep it, people's rights, and how to contact you.
2. Link to it from every form with a short line such as "We use your details only to reply to your enquiry."
3. Get clear consent for marketing — an unticked checkbox for newsletters or promotional SMS, separate from the enquiry itself. Keep a record of when and how each person agreed.
4. Handle cookies properly — if you use analytics or advertising tags, tell visitors and ask before loading them. A site with no tracking does not need a cookie banner.
5. Use HTTPS everywhere and keep the website software, plugins and server up to date.
6. Protect admin areas — strong unique passwords, two-factor login where available, and remove accounts for people who have left.
7. Limit what forms collect, and do not email full form submissions with sensitive details around the office.
8. Sign agreements with your processors (hosting, SMS, email, payments) or check their terms cover data protection.
9. Set a retention period and delete what you no longer need.
10. Know what to do in a breach (see below).

Do you need to register with the ODPC?

Under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, data controllers and processors must register with the ODPC unless they qualify for an exemption. In summary:

• Smaller organisations — those with an annual turnover below KES 5 million and fewer than 10 employees — are generally exempt.
• Some sectors must register regardless of size, including education, health, financial services, telecommunications, transport, hospitality, property management, direct marketing and others listed in the regulations.

Registration is done online on the ODPC portal and is renewed periodically. The list of mandatory sectors and the fees can change, so confirm the current position on the ODPC website before deciding.

People's rights — and how your website should support them

Give one clear contact — usually an email address in the privacy policy — for these requests, and keep a simple log of each request and your response.

If there is a data breach

1. Contain it — change passwords, take the affected form or page offline, restore from a clean backup.
2. Find out what data and how many people are affected.
3. Notify the ODPC, and the affected people where required.
4. Fix the cause and write down what happened and what you changed.

Penalties for getting it wrong

The ODPC can issue enforcement notices and administrative fines of up to KES 5 million or 1% of the previous year's annual turnover, whichever is lower. People who suffer harm can also claim compensation. The ODPC has published decisions against Kenyan businesses — including for unsolicited marketing messages and for sharing customers' photos without consent — so the risk is real for small organisations too.

Special cases: children, marketing and sensitive data

• Children — processing a child's data needs a parent's or guardian's consent. Relevant for schools; see what a school website should include.
• Direct marketing — get consent and offer an easy opt-out. See our Bulk SMS guide.
• Sensitive data — health, religion and similar data need stronger safeguards and a clear legal basis. Churches, clinics and SACCOs should take particular care.

How Elvinsoft can help

We build websites with data protection in mind: minimal forms, HTTPS, secure admin areas, no tracking unless you choose it (and then with a consent notice), and a privacy policy that reflects how your site actually works. See Website Maintenance & Support or ask us to review your website.