Overview
The Data Protection Act, 2019 (Kenya) is Kenya’s primary data protection legislation, enacted to protect individuals' privacy rights and regulate the processing of personal data. The Act establishes the Office of the Data Protection Commissioner (ODPC) as the national supervisory authority responsible for overseeing compliance, investigating complaints, and enforcing data protection requirements. It sets out the rights of data subjects, the obligations of data controllers and processors, principles for lawful data processing, requirements for breach notification, protections for sensitive personal data, and conditions for cross-border data transfers. The Act also promotes accountability, transparency, and security in the handling of personal information, ensuring that personal data is processed fairly and in accordance with established privacy standards.