Data Protection Act, 2019, enforcement, penalties and compensation
Data Protection Act, 2019 (No. 24 of 2019), Part VIII (ss. 56-65, 72-74)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 25 November 2019.
An enforcement supervision rule binding public and private bodies.
As of 4 September 2026.
What it requires
- Expect the Office of the Data Protection Commissioner to investigate a data subject's complaint and to be able to issue a penalty notice for a contravention of the Act.
- Compensate a data subject who suffers damage from your contravention of the Act.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A general penalty of a fine of up to KES 3,000,000 or imprisonment of up to ten years, or both, applies to a contravention of the Act for which no specific penalty is provided; separate offences include unlawful disclosure of personal data (s. 72) and, in the course of a Data Commissioner investigation, furnishing information known to be false or misleading (s. 57(3)); giving the Data Commissioner false or misleading information in the exercise of the Commissioner's section 9 powers, or obstructing the Commissioner, carries a fine of up to KES 5,000,000 or imprisonment of up to two years, or both (s. 61).
Penalty structure
The Data Commissioner's administrative penalty notice is capped at KES 5,000,000, or, in the case of an undertaking, at whichever is lower of that amount and one per cent of its annual turnover for the preceding financial year (s. 63).
- Rule
- Fixed only
- As of
- 4 September 2026
- Currency
- KES
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
Office of the Data Protection Commissioner (ODPC)
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A data subject may complain to the Data Commissioner, who may issue a penalty notice and, on appeal, be reviewed by the High Court. A person who suffers damage from a contravention of the Act is entitled to compensation from the controller or processor. Unlawful disclosure of personal data and giving false or misleading information to the Data Commissioner are separate criminal offences, and any other contravention with no specific penalty carries a general criminal penalty.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach
Read the law
official consolidated Act text, Kenya Law (National Council for Law Reporting)