Data Protection Compliance in Kenya
A practical guide to the Kenya Data Protection Act, 2019: registration, lawful processing, consent, data subject rights, impact assessments, transfers, breaches and ODPC enforcement.
Enrol in this Course
- 📦 5 modules
- 📹 20 lessons
- 📝 5 quizzes
- 🎓 Certificate on completion
- ♾ Learn at your own pace, online
Every Kenyan organisation holds personal data: staff files, customer records, CCTV footage, M-Pesa numbers, patient notes and student records. The Data Protection Act, 2019 and its regulations set binding rules for that data, and the Office of the Data Protection Commissioner (ODPC) actively investigates complaints, issues penalty notices and orders compensation.
This course gives compliance officers, HR practitioners, IT and operations managers, business owners and data protection officers a practical understanding of Kenyan data protection law. You will learn how to register, choose a lawful basis, handle data subject requests, run impact assessments, manage processors and transfers, and respond to breaches, with sector examples from finance, health, education and retail.
What you will learn
- How the Act, the three sets of regulations and the ODPC fit together, and who must register
- The data protection principles, lawful bases, valid consent, sensitive and children’s data, and direct marketing rules
- Data subject rights, how to handle requests on time, automated decisions and the ODPC complaints process
- How to build a compliance programme: records, DPOs, impact assessments, security, processor contracts and cross-border transfers
- How to manage breaches, how enforcement works, and what good practice looks like in key sectors
How the course works
There are five modules, each with four lessons and a short quiz. You need 70% on each quiz to complete the course and earn your certificate.
About figures in this course
Fees, thresholds, response times and penalty amounts are shown as examples of the law as at 2026, not fixed rules, and are expected to change, particularly as the Data Protection (Amendment) Bill, 2025 progresses. All figures are collected in one Course reference table at the end of the final lesson. Always confirm the current position through official channels such as the ODPC and the Kenya Gazette.
Course Curriculum
5 modules · 20 lessons · 5 quizzes
Module 1: Foundations
- 1.1 Why Data Protection Matters (Start Here)
- 1.2 The Act, the Regulations and the ODPC
- 1.3 Key Terms: Personal Data, Sensitive Data, Controllers and Processors
- 1.4 Registering with the ODPC
-
Module 1 Quiz Enrol to take
Module 2: Principles and Lawful Processing
- 2.1 The Data Protection Principles (Start Here)
- 2.2 Lawful Bases, Including Consent
- 2.3 Sensitive Data and Children's Data
- 2.4 Direct Marketing and Commercial Use
-
Module 2 Quiz Enrol to take
Module 3: Data Subject Rights
- 3.1 The Rights of Data Subjects (Start Here)
- 3.2 Handling Access and Erasure Requests
- 3.3 Automated Decisions and Profiling
- 3.4 Complaints to the ODPC
-
Module 3 Quiz Enrol to take
Module 4: Building a Compliance Programme
- 4.1 Accountability and Records (Start Here)
- 4.2 Data Protection Impact Assessments
- 4.3 Security Measures and Processor Contracts
- 4.4 Cross-Border Transfers
-
Module 4 Quiz Enrol to take
Module 5: Breaches, Enforcement and Sector Practice
- 5.1 Managing a Data Breach (Start Here)
- 5.2 ODPC Investigations, Penalties and Compensation
- 5.3 Data Protection in HR, Banking, Health and Marketing
- 5.4 Audits, Emerging Issues and the Reference Table
-
Module 5 Quiz Enrol to take