The Data Protection Act 2019 in Outline

The Kenyan DPA is structured around eight principles in Section 25 that align closely with GDPR Article 5: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity, accountability, and a Kenyan addition explicitly affirming the constitutional right to privacy. The lawful bases in Section 30 mirror the GDPR: consent, contract, legal obligation, vital interests, public interest, and legitimate interest. The Act applies to any data controller or processor that processes personal data of data subjects located in Kenya, with extraterritorial reach that captures offshore publishers serving Kenyan visitors.

Two structural features of the Act matter operationally. First, controllers and processors above specified thresholds must register with the ODPC, and the Commissioner has been visible about pursuing unregistered operators. Second, the Act requires the appointment of a data protection officer where processing scope crosses defined thresholds — including any large-scale processing of personal data, which captures most ad-supported publishers and SaaS operators.

How the DPA Treats Cookies and Online Tracking

The DPA does not contain a cookie-specific provision; the consent and information obligations flow from Sections 25, 30, and 32 of the Act. The ODPC's 2024 Guidance Note on Digital Marketing and Behavioural Advertising articulated specific expectations for online tracking that publishers serving Kenyan traffic need to design against.

Affirmative consent for non-essential cookies

The ODPC's position is unambiguous: scroll-as-consent and continued-use-as-consent do not satisfy the freely-given and unambiguous prongs of Section 32. An explicit affirmative action is required for non-essential cookies. The interpretation tracks the EDPB Cookie Banner Taskforce position closely.

Granular category controls

The 2024 guidance is explicit that banners must allow the user to accept and reject categories independently. Bundled "Accept all" without an equivalent "Reject all" on the same surface is treated as a defect, as is mislabeling analytics or marketing cookies as strictly necessary.

Children's data and consent capacity

The DPA treats data subjects under 18 as children for consent purposes, with parental authorization required for processing. For publishers whose audiences include Kenyan minors, the cookie consent framework needs an age-aware path that does not assume adult capacity.

Cross-border transfer rules

Section 48 of the Act governs transfers outside Kenya. Transfers may proceed under one of several mechanisms: adequacy designation by the Commissioner, appropriate safeguards (including the ODPC's standard contractual clauses, issued in 2023), explicit consent, or specific derogations. The ODPC has been increasingly explicit that "we use Google Analytics" is not a sufficient response to a cross-border transfer inquiry; the publisher must be able to identify the actual mechanism authorizing the flow.

The ODPC's Enforcement Posture

The ODPC has been the most active African data protection regulator since 2022, both in absolute case volume and in the visibility of its actions. Three patterns shape its enforcement approach.

Visible early fines

The ODPC imposed administrative fines on several fintech, digital lending, and credit bureau operators starting in 2022, establishing precedent for monetary remedies under the Act. The communications around these cases have been deliberately public, signaling that enforcement is real and not just notional.

Sectoral focus on fintech and credit

The fintech and digital credit sector — which is unusually large in Kenya relative to the country's overall economy — has received the most concentrated ODPC attention. For publishers operating ad-supported businesses targeting fintech users, the regulatory atmosphere around the audience is more charged than it would be in many comparable markets.

Coordination with regional regulators

The ODPC participates in the African Network of Data Protection Authorities and maintains working relationships with the EDPB and the Nigerian NDPC. Cross-border investigations involving Kenyan and European traffic are handled through coordinated procedures.

A Practical Compliance Checklist

Six concrete questions to answer for any cookie banner serving Kenyan traffic.

• Is the controller registered with the ODPC? If the publisher's processing crosses the registration threshold, confirm registration is current and the registration certificate is on file.
• Is there an explicit first-layer reject? The reject path must sit on the same surface as accept, with comparable prominence.
• Are categories granular? Necessary, analytics, and marketing must be separately controllable.
• Is an age-aware path provided? For audiences that may include Kenyan minors, the consent flow needs a defensible age-gate or parental-authorization step.
• Are cross-border transfers documented? For each non-Kenyan destination, identify the Section 48 mechanism authorizing the transfer (adequacy, ODPC SCCs, derogation).
• Is consent logging audit-grade? Timestamp, banner version, choice, and lawful basis must be recoverable on demand.

Where Kenya Fits in a Multi-Jurisdiction Stack

Kenya is one of the four most operationally consequential African data protection regimes — alongside Nigeria, South Africa, and Egypt's emerging framework — and its 2019 head-start has translated into the most mature enforcement posture on the continent. For publishers building toward pan-African operations, the Kenyan DPA is the de facto template that newer regional laws have used: registration requirements, mandatory DPOs above thresholds, GDPR-style lawful bases, and cross-border transfer rules that mirror Chapter V of the GDPR with regional adaptations. Compliance work for Kenya parallels the European standard with three meaningful additions: ODPC registration, age-aware consent capacity, and the ODPC's specific standard contractual clauses for cross-border transfers. A consent management platform built to European norms handles the bulk of the work; the Kenyan additions are operational layers on top, not architectural rebuilds.