Data Protection and Cyber Security Lawyers Across Kenya

Kenya’s Data Protection Act, 2019 introduced a comprehensive legal framework for how personal data is collected, stored, processed, and shared, and it has been actively enforced since coming into force. A data protection lawyer, formally called an advocate, advises businesses and individuals on compliance with the Act, represents them before the Office of the Data Protection Commissioner (ODPC), and handles disputes involving data breaches, privacy violations, and cyber security incidents. With the ODPC having issued over KES 26 million in fines through 2024, data protection compliance is no longer optional. This page lists verified data protection and cyber security lawyers in Kenya and explains how the law works.

The Data Protection Act, 2019

The Data Protection Act, 2019 (Act No. 24 of 2019) gives effect to Article 31 of the Constitution, which guarantees every person the right to privacy. Modelled broadly on the European Union’s General Data Protection Regulation (GDPR), the Act sets out the obligations of data controllers and processors, the rights of data subjects, and the powers of the ODPC to enforce compliance. Data controllers and processors must have a lawful basis for processing personal data, comply with the core processing principles of lawfulness, fairness, transparency, purpose limitation, and data minimisation, and respect data subjects’ rights to access, correct, erase, or restrict their data. The Act applies to both the public and private sectors, and to entities outside Kenya that process the data of Kenyan residents.

Registration and Compliance Obligations

Organisations that meet any of the prescribed thresholds must register with the ODPC. Registration is required where the organisation has annual turnover above KES 5 million, more than ten employees, processes sensitive personal data, processes the data of ten thousand or more data subjects per year, or operates in regulated sectors including financial services, healthcare, education, and telecommunications. Registration is done through the ODPC online portal. Organisations that are required to process personal data on a large scale, carry out large-scale systematic monitoring, or are public bodies must appoint a Data Protection Officer (DPO). High-risk processing activities require a Data Protection Impact Assessment (DPIA) before commencing, and where the DPIA reveals high risk, the ODPC must be consulted at least sixty days before processing begins. A data protection lawyer can assess your obligations and build a compliance programme.

Data Breaches and Enforcement

A data breach must be reported to the ODPC within seventy-two hours of the controller becoming aware of it, and where the breach creates a high risk for data subjects, those individuals must also be notified without delay. The ODPC can impose administrative fines of up to KES 5 million or one per cent of annual turnover, whichever is lower, issue enforcement notices, order compensation to data subjects, and refer matters for criminal prosecution where the offence warrants it. Daily fines of KES 10,000 apply for continuing violations. A data protection lawyer can guide your organisation through a breach response, manage ODPC communications, and represent you in enforcement proceedings.

Data Localisation and Cross-Border Transfers

Kenya’s Data Protection Act imposes a data localisation requirement under Section 50: every data controller or processor must ensure that at least one serving copy of personal data is stored on a server or data centre located within Kenya. For personal data classified as strategic to state interests, all processing must occur within Kenya. Cross-border transfers of personal data are permitted only where adequate safeguards can be demonstrated to the ODPC, such as the receiving country having comparable data protection laws or the use of contractual clauses. Transfers of sensitive personal data abroad require explicit consent in addition to the safeguards. These requirements have significant implications for organisations using international cloud computing providers.

How to Choose a Data Protection Lawyer

Data protection is a technical and regulatory field: match the lawyer to your compliance needs or dispute, confirm they are properly registered, and act early rather than after a breach or enforcement action.

• Confirm the lawyer is a registered advocate with the Law Society of Kenya
• Choose a lawyer with genuine, current experience in data protection law and ODPC practice
• Address compliance proactively: the ODPC is actively enforcing the Act and fines are real
• In a breach situation, instruct a lawyer immediately to manage the 72-hour notification deadline
• Ask how they charge and get a written fee agreement before work begins