Kenya is East Africa’s fintech and startup hub, and its Office of the Data Protection Commissioner (ODPC) is one of the continent’s most active enforcers, regularly fining digital lenders and consumer apps.
Most startups processing personal data in Kenya must register with the ODPC, unless they fall under the small-business exemption.
- Core data law
- Data Protection Act 2019
- Regulator
- Office of the Data Protection Commissioner (ODPC)
- Registration
- Mandatory above thresholds; mandatory for listed sectors
- Breach notice
- Within 72 hours to the ODPC
- Penalties
- Up to KES 5 million or 1% of annual turnover
- Hot topic
- Enforcement against digital lenders and marketing
Who needs to comply
Startups processing personal data in Kenya or of people in Kenya
The Act applies to controllers and processors established in or targeting Kenya.
Fintech, lending, health, education and marketing businesses
These are listed for mandatory registration regardless of size.
The laws, in detail
01Data Protection Act 2019 & Regulations 2021
Principles, rights, registration, DPOs, breach notification, DPIAs and transfers.
When it applies
Processing in Kenya, or of data subjects in Kenya.
What you must do
- Register with the ODPC where required
- Lawful basis and consent for direct marketing
- Notify the ODPC within 72 hours of qualifying breaches
- DPIA for high-risk processing
- Transfer safeguards or consent for sensitive data abroad
Regulator
ODPC
Penalties
Administrative fines up to KES 5 million or 1% of annual turnover, whichever is lower; compensation orders.
02CBK Digital Credit Providers Regulations 2022
Licensing and conduct of digital lenders.
When it applies
Non-deposit-taking businesses offering digital credit in Kenya.
What you must do
- Obtain a Central Bank of Kenya licence
- Fair debt collection; no use of borrowers’ contacts to shame
- Transparent pricing and data protection compliance
Regulator
Central Bank of Kenya
Penalties
Licence refusal or revocation and penalties.
03Computer Misuse and Cybercrimes Act 2018
Cyber offences and critical information infrastructure duties.
When it applies
Organisations and service providers in Kenya.
What you must do
- Protect critical information infrastructure where designated
- Report specified cyber incidents
- Cooperate with investigations
Regulator
National Computer and Cybercrimes Co-ordination Committee
Penalties
Fines and imprisonment.
04Virtual Asset Service Providers Act 2025
Licensing and AML rules for virtual asset service providers.
When it applies
Exchanges, wallets, brokers and other VASPs serving Kenya.
What you must do
- Licence from the CBK or CMA depending on activity
- AML/CFT compliance
- Follow regulations as they are issued
Regulator
Central Bank of Kenya; Capital Markets Authority
Penalties
Penalties under the Act.
Compliance checklist
01 · Before you launch
- Register with the ODPC
- Privacy notice
- Direct marketing consent and opt-out
02 · At launch
- 72-hour breach process
- DPIA for high-risk processing
- Transfer safeguards
03 · As you scale
- Renew registration
- Review lending and collection practices
Key dates
- Nov 2019Data Protection Act in force
- 2021Registration and general regulations
Common mistakes
- Contacting borrowers’ contacts for debt collection
- Marketing without consent
- No ODPC registration
FAQs
Is registration with the ODPC mandatory?
For most controllers and processors, yes, with exemptions for small entities outside listed sectors.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.