The Office of the Data Protection Commissioner (ODPC) has begun full-scale enforcement of the Data Protection Act, 2019, impacting businesses across Kenya. Companies collecting, processing, or storing personal data are now required to comply with strict data handling, storage, and consent procedures. Non-compliance can attract significant fines, including up to KES 5 million or 1% of annual turnover.

This shift is part of Kenya’s broader strategy to create a secure digital economy and safeguard citizens' digital identities. Businesses must register as data controllers or processors with the ODPC and adopt proper privacy policies, consent mechanisms, and breach notification systems. Sectors like healthcare, e-commerce, financial services, and education are especially affected.

At Kabugu & Co. Advocates, we are actively assisting clients with registration, policy drafting, and staff training to meet these new legal requirements. Our team urges companies to treat this seriously — compliance is not only legal protection but also a trust-building opportunity with customers in an increasingly privacy-conscious society.