This archive report was first published on 9 November 2019.
On November 9, 2019, President Uhuru Kenyatta assented to the Data Protection Act 2019, a move that will significantly change how public and private entities handle users' information in Kenya.
The Act makes it mandatory for entities and individuals dealing with users' personal information to seek permission before collecting, processing, or storing this data.
According to the law, users have the right to object to the processing of their personal data for direct marketing, including profiling, and can demand to have false data corrected or deleted.
Companies must inform users of any personal data they are collecting, the purpose for collecting that data, and how long it will be stored.
However, this requirement is exempted where the data is required or authorised by law or used for historical, statistical, journalistic, literary, or research purposes.
The Data Protection Act 2019 makes Kenya the 24th country in Africa to have data protection legislation.
Companies found guilty of violating the Act face fines of up to 2% of their annual turnover.
