Data Protection Act, 2019

Data Protection Act, 2019 (No. 24 of 2019), ss. 1-30 (establishment, principles and obligations)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 25 November 2019.

A comprehensive regime rule binding public and private bodies.

As of 4 September 2026.

What it requires

Process personal data lawfully, fairly and transparently, only for an explicit and legitimate purpose, and collect no more than is necessary for that purpose.
Register with the Office of the Data Protection Commissioner if your volume or category of processing meets the prescribed threshold.
Obtain consent from a child's parent or guardian, verified through an age-verification mechanism, before processing that child's personal data.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Data Protection Act, 2019 establishes the Office of the Data Protection Commissioner and requires every data controller or processor to process personal data lawfully, fairly and transparently, and only for an explicit and legitimate purpose that is proportionate to what is collected.

A data controller or processor must register with the Data Commissioner where the prescribed threshold is met, and must not process a child's personal data unless a parent or guardian has consented and the controller has implemented a mechanism to verify the child's age. A data subject's consent may be withdrawn at any time, without affecting the lawfulness of processing already carried out before the withdrawal.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
serves_minors

Read the law

official consolidated Act text, Kenya Law (National Council for Law Reporting)

Back to the example · Lint your app