Data Privacy and Protection in Kenya: A Regulatory Review

This regulatory review, prepared for FSD Kenya, examines Kenya's data protection framework with a deliberately broad lens. Beyond the Data Protection Act, 2019 (DAPA), it considers the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Why look beyond DAPA

Both the GDPR and the CCPA follow the people whose data is processed rather than where a firm is based. The GDPR protects residents of the European Economic Area wherever they are, and the CCPA protects California residents even when they are temporarily outside the state. Kenyan businesses that process those individuals' data, including many fintechs, can therefore fall within their scope.

What the review covers

• A detailed assessment of DAPA against the relevant articles and recitals of the GDPR and the CCPA.
• The practical challenges fintechs and other firms are likely to face in implementing these regimes.
• Areas of DAPA that remain open to interpretation or need clarification, with examples of how other jurisdictions have addressed them.
• Policy recommendations to strengthen the regulatory framework and support a well-functioning market.