Digital credit grew in Kenya faster than its compliance did, and data protection became the flashpoint: lending apps that harvested phone contacts, listed borrowers publicly, or pressed guarantors through messaging have all faced the consequences. For fintech teams building on that market today, the Data Protection Act 2019 is not an afterthought , it is … Read more
Your HR platform is hosted in Europe. Your customer support runs from India. Your backups sit in a data centre abroad. Each of these ordinary arrangements may involve moving personal data out of Kenya , and that is where the rules begin. Can personal data be transferred outside Kenya? Yes, but not freely. The Data … Read more
A recruitment tool screens out candidates. A chatbot gives a customer wrong information. A model trains on personal data gathered from the web. Kenyan businesses are already using such systems , and asking who answers when they cause loss. Is there an AI law in Kenya? Kenya does not yet have a standalone statute dedicated … Read more
Your marketing team wants to send ten thousand promotional SMS messages tonight. Before the send button is pressed, Kenyan law asks a simple question: what right do you have to message these people? Do you need consent to send marketing messages in Kenya? Direct marketing is processing, and the Data Protection Act 2019 applies to … Read more
CCTV in the stockroom, software that logs keystrokes, GPS units in delivery vans. Employers have more ways to watch staff than ever, and employees increasingly ask where the line falls under Kenyan law. Can employers monitor employees in Kenya? Monitoring is not banned, but it is regulated. The Data Protection Act 2019 treats employee information … Read more
You are planning a new app, a CCTV rollout or a loyalty programme. If the project processes personal data on a large scale or in sensitive ways, Kenyan law may expect a data protection impact assessment before you launch. Doing it early is cheaper than retrofitting compliance after launch. When is a data protection impact … Read more
An employee’s laptop is stolen from a parked car. It holds a spreadsheet of client names, phone numbers and identity card copies. What happens next is governed by Kenya’s data breach notification rules , and the first hours matter. What counts as a personal data breach in Kenya? A breach is wider than a hack. … Read more
CCTV in the shop, email on company servers, a GPS tracker in the delivery vehicle: monitoring is easier than ever, and so is getting it wrong. The Data Protection Act 2019 applies to employee personal data like any other, and it reshapes what employers may collect, watch and keep. Setting the framework early avoids most … Read more
Vendors, clients and regulators all ask whether your organisation is a data controller or a data processor. The answer shapes who must register, who answers complaints and how your contracts should be drafted , and the two roles are often confused. What is the difference between a controller and a processor? A data controller decides … Read more
If your organisation keeps a customer list, runs a payroll or sends a newsletter, Kenyan data protection law already applies to you. One of the first questions organisations ask is whether formal registration with the Office of the Data Protection Commissioner is required before personal data may lawfully be processed. Who must register with the … Read more
Email: [email protected] · Contact page
