← All Guides

Data Privacy Compliance for Kenyan SMEs: The 2026 Guide

📅 1 September 2026 · ✅ Last verified: 12 October 2026 · 📖 11 min · Registration & Legal

You collect customer names, phone numbers, M-Pesa details, delivery addresses, and maybe even ID numbers. You store them in WhatsApp, Excel, your phone, and maybe a CRM. Did you know that makes you a data controller under Kenyan law — with legal obligations you probably didn't know you had?

This guide explains the Data Protection Act 2019 for Kenyan SMEs: when it applies, what you must do, and how to comply without hiring a lawyer.

1. Does the Data Protection Act Apply to You?

Yes, if you collect or store personal data. Personal data includes:

• Customer names, phone numbers, email addresses
• M-Pesa transaction records
• Delivery addresses
• Employee records (HR files, payroll data)
• CCTV footage
• Website visitor data (cookies, contact forms)
• Supplier contact details
• Customer credit/loan records

You are a "data controller" if you determine why and how personal data is processed.

You are a "data processor" if you process data on behalf of another business.

Most SMEs are data controllers.

2. When Must You Register with ODPC?

ODPC registration is mandatory unless both exemption conditions are met. For a profit-making entity, the general test is total income below KES 5 million in the previous year and fewer than 10 employees. Some listed activities still require registration even when both conditions are met.

Regulation 13 defines “revenue” for profit-making entities as total income in the year immediately before registration. For non-profit entities, it defines “turnover” as the utilized annual budget for that year. However, ODPC's current FAQ says public entities and non-profit-making entities such as charities and religious institutions must register regardless of turnover or revenue. The regulation and ODPC FAQ do not clearly reconcile that difference; non-profits should confirm directly with ODPC before relying on an exemption.

Registration is required if:

• Your turnover or revenue is KES 5 million or more, or you employ 10 or more people
• You process personal data for a non-exempt purpose or sector, such as direct marketing, financial services, health, education, hospitality, property management, transport, or genetic data

Registration fee: ODPC lists one-time tier fees of KES 4,000 (micro/small), KES 16,000 (medium), and KES 40,000 (large). Confirm your category and current fee on ODPC's guidance.

How to register: ODPC Registration Portal

Note: Even if you fall within the exemption, the Data Protection Act principles still apply. Registration certificates are valid for 24 months; follow ODPC's renewal instructions.

3. The 7 Principles of Data Protection

1. Lawful, Fair and Transparent Processing

• Tell people why you're collecting their data
• Don't collect data through deception
• Have a privacy notice (even a simple one)

2. Purpose Limitation

• Only collect data for a specific, stated purpose
• Don't use customer phone numbers for marketing unless they consented

3. Data Minimization

• Only collect what you actually need
• Don't ask for ID numbers if you don't need them

4. Accuracy

• Keep personal data accurate and up to date
• Correct errors when notified

5. Storage Limitation

• Don't keep data longer than necessary
• Delete customer data when the relationship ends (unless legally required to keep it)

6. Integrity and Confidentiality

• Protect data against unauthorized access, loss, or theft
• Use passwords, encryption, and access controls

7. Accountability

• Be able to demonstrate compliance
• Keep records of your data processing activities

4. Lawful Bases for Processing Data

You must have a legal reason to process personal data:

For SMEs, the most common bases are: contract, consent, and legal obligation.

5. Consent Requirements

If you rely on consent:

• It must be freely given, specific, and informed
• The person must actively opt in (no pre-ticked boxes)
• You must be able to prove consent (keep records)
• They can withdraw consent at any time
• Marketing messages require explicit consent

Practical example:

If you collect phone numbers for delivery updates, that's "contract" basis.

If you later want to send promotional messages, you need separate consent.

6. Your Privacy Notice

Every business needs a privacy notice. It can be simple:

[Business Name] collects your name, phone number, and delivery address

to fulfill your order and communicate about your delivery.

We do not share your data with third parties except as required for

delivery and legal compliance.

You can request deletion of your data by contacting [email/phone].

We retain tax records for at least five years from the end of the relevant reporting period, and longer where the law requires it. We retain other personal data only for as long as needed for its lawful purpose.

Where to display:

• Website (footer link)
• WhatsApp business profile
• Physical premises (small sign)
• Order forms

7. Employee Data

Some employee records may contain sensitive personal data. The Act defines specific sensitive categories, including health, biometric, genetic, family, and property details; ordinary employment records are not automatically sensitive merely because they relate to an employee.

• National ID numbers
• KRA PINs
• NSSF/SHIF numbers
• Bank account details
• Performance records
• Disciplinary records

Requirements:

• Have an employee privacy notice
• Limit access to HR/payroll staff only
• Share employee data only where a lawful basis under section 30 applies, and disclose only what is necessary with appropriate safeguards
• Secure physical and digital records
• Delete data when employment ends (after legal retention period)

8. Data Breach Response

A data breach is any unauthorized access, loss, or disclosure of personal data.

Examples:

• Laptop with customer data stolen
• Employee leaks customer phone numbers
• WhatsApp group exposes customer details
• Cloud account hacked

What to do:

1. Contain the breach — Stop further unauthorized access
2. Assess the risk — How many people affected? What data?
3. Notify ODPC — Within 72 hours if the breach poses risk to individuals
4. Notify affected individuals — If high risk
5. Document everything — Keep records of the breach and your response

ODPC breach reporting: Report a data breach to ODPC

9. Cross-Border Data Transfers

If you use cloud services (Google Workspace, AWS, international CRMs), your data may be stored outside Kenya.

Before transferring personal data outside Kenya, use a route permitted by sections 48–49 of the Data Protection Act and Part VII of the General Regulations. This may include an adequacy decision, appropriate safeguards proved to the Data Commissioner, or a transfer necessary for a purpose listed in section 48. If none of those routes applies, regulation 46 permits transfer only after the data subject explicitly consents and is informed of the possible risks. A transfer of sensitive personal data also requires the data subject consent and confirmation of appropriate safeguards under section 49.

Practical tip: Cloud services may involve cross-border processing. Review the provider terms and confirm that the transfer meets a permitted route; a data processing agreement or privacy-notice disclosure alone does not establish compliance.

10. Penalties for Non-Compliance

An administrative monetary penalty under section 63 may be up to KES 5 million or 1% of the undertaking's annual turnover for the preceding financial year, whichever is lower.

Unlawful disclosure or sale of personal data may be a criminal offence where the conditions in section 72 are met. Where the Act does not set a specific criminal penalty, section 73 provides for a fine of up to KES 3 million, imprisonment for up to ten years, or both. Specific offences may carry different penalties; these figures are not a universal penalty for every privacy failure.

ODPC can also issue enforcement notices, compliance orders, and public reprimands.

11. Practical Compliance Checklist for SMEs

• □ Determine if you need to register with ODPC
• □ Draft a simple privacy notice
• □ Display privacy notice on website/premises
• □ Get explicit consent for marketing messages
• □ Limit data access to authorized staff only
• □ Secure devices with passwords/encryption
• □ Delete data you no longer need
• □ Have a breach response plan
• □ Train staff on data handling
• □ Review compliance annually

12. What You Should Do This Week

1. [ ] Audit what personal data you collect and store
2. [ ] Determine if you need ODPC registration
3. [ ] Draft your privacy notice
4. [ ] Update your WhatsApp business profile with privacy info
5. [ ] Review how you collect marketing consent
6. [ ] Secure your customer data (passwords, access controls)

Frequently Asked Questions

Do I need to register with ODPC if I have 3 employees?

If your turnover or revenue is below KES 5 million and you employ fewer than 10 people, you may qualify for an exemption unless your processing falls within a non-exempt purpose or sector. The Data Protection Act principles still apply; check current ODPC guidance.

Can I send marketing messages to my existing customers?

Only if they explicitly opted in. Past purchase alone is not consent for marketing. Use the "contract" basis for order-related messages only.

What if a customer asks me to delete their data?

Respond to the request within 14 days. You may refuse erasure to the extent the law permits or requires you to retain the data. Tax records generally must be retained for at least five years from the end of the relevant reporting period, and longer where the law requires it.

Do I need consent to store employee data?

Employee data is typically processed under "legal obligation" (tax, NSSF, SHIF) and "contract" (employment). But you still need an employee privacy notice and must secure the data.

Is WhatsApp Business compliant?

WhatsApp Business is end-to-end encrypted, but you must still have a privacy notice, obtain consent for marketing, and not share customer data in groups without consent.

Related Guides

• Employment Contracts in Kenya
• eTIMS Compliance Guide

Sources and update record

Updated 26 October 2026: Distinguished sensitive employee data from ordinary records and clarified lawful bases for processing.

Registration scope checked against Regulation 13 and ODPC's current FAQ; the non-profit guidance difference is disclosed above.

• Data Protection Act 2019
• Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, regulation 13
• ODPC FAQs
• ODPC Registration Guidance Note
• ODPC Registration Portal
• ODPC Guidelines

Stay updated

Get the next guide in your inbox.

Email address

Subscribe

No spam · Unsubscribe anytime.