Every Kenyan website that collects a name, an email or a phone number is processing personal data , and the Data Protection Act 2019 applies from the first field of the contact form. A privacy policy is where that legal duty becomes visible to users.
Does Kenyan law require a privacy policy?
The law requires transparency: a data controller must tell a data subject, at or before collection, who is collecting the data, the purposes, the lawful basis, the recipients, transfers and the person’s rights. Online, a published privacy notice is the practical instrument for that duty , and for an organisation registered with the Office of the Data Protection Commissioner, it is one of the first things an inspection requests. The Act is published on Kenya Law.
What should a Kenyan privacy notice cover?
- Who the controller is, with contacts for data protection queries
- What is collected, and the specific purposes for each item
- The lawful basis for each purpose , consent, contract, legal obligation, legitimate interests
- Recipients of the data, including processors and cross-border transfer safeguards
- How long data is kept, and the criteria for deciding
- The data subject’s rights , access, rectification, objection , and how to complain to the ODPC
- Cookies and similar technologies, addressed clearly rather than in passing
Are cookies and trackers covered too?
Yes. Analytics, advertising pixels and embedded social tools all process personal data, and non-essential trackers require consent before they run , a banner is the visible sign of that obligation, and pre-ticked boxes are not consent. The notice should distinguish necessary cookies and give a genuine choice.
Should you copy a foreign privacy policy?
Foreign templates reference rights and regulators that do not exist here and omit the Kenyan duties that do, such as registration and breach notification. A mismatched policy is itself evidence of non-compliance. Websites also need terms of use alongside the notice , a separate contract governing acceptable use, disclaimers and disputes. Our contract lawyers draft website terms and privacy notices, and our governance and advisory practice reviews the compliance behind them; our practice areas page sets out the wider work.
For guidance on your specific situation, contact CS Advocates LLP , call, WhatsApp, or book a confidential consultation at our Westlands, Nairobi office.