Every Kenyan organisation holds personal data: staff files, customer records, CCTV footage, M-Pesa numbers, patient notes and student records. The Data Protection Act, 2019 and its regulations set binding rules for that data, and the Office of the Data Protection Commissioner (ODPC) actively investigates complaints, issues penalty notices and orders compensation.
This course gives compliance officers, HR practitioners, IT and operations managers, business owners and data protection officers a practical understanding of Kenyan data protection law. You will learn how to register, choose a lawful basis, handle data subject requests, run impact assessments, manage processors and transfers, and respond to breaches, with sector examples from finance, health, education and retail.
What you will learn
- How the Act, the three sets of regulations and the ODPC fit together, and who must register
- The data protection principles, lawful bases, valid consent, sensitive and children’s data, and direct marketing rules
- Data subject rights, how to handle requests on time, automated decisions and the ODPC complaints process
- How to build a compliance programme: records, DPOs, impact assessments, security, processor contracts and cross-border transfers
- How to manage breaches, how enforcement works, and what good practice looks like in key sectors
How the course works
There are five modules, each with four lessons and a short quiz. You need 70% on each quiz to complete the course and earn your certificate.
About figures in this course
Fees, thresholds, response times and penalty amounts are shown as examples of the law as at 2026, not fixed rules, and are expected to change, particularly as the Data Protection (Amendment) Bill, 2025 progresses. All figures are collected in one Course reference table at the end of the final lesson. Always confirm the current position through official channels such as the ODPC and the Kenya Gazette.
Reviews
There are no reviews yet.