Call Recording Consent in Kenya: Rules for AI Voice Agents

If your AI voice agent records calls in Kenya, every recording is personal data under the Data Protection Act 2019, and you need a lawful basis, clear disclosure, and provable consent in place before the first call. This is not theoretical: in February 2026 the Office of the Data Protection Commissioner ordered Liquid Telecommunications Kenya to pay KES 700,000 in compensation over a single call recorded after the other party refused. This guide covers what the law actually says, what the regulator has enforced so far, and the exact compliance setup to build into a voice agent before it goes live.

Kenya has no one-party consent rule

Businesses that have operated in the US or UK often assume Kenya works the same way: if you are a party to the call, you may record it. Kenya has no statute that says this. There is no one-party or two-party consent classification anywhere in Kenyan law.

The closest criminal provision is section 17 of the Computer Misuse and Cybercrimes Act 2018, which makes it an offence to intercept a transmission over a telecommunications system "without authorization", punishable by a fine of up to KES 10 million or five years in prison. The Act never defines "authorization" for a private individual, and it never says that being a participant in a conversation makes your own recording authorized. Courts and the regulator have instead applied a different law: the Data Protection Act 2019, which came into force on 25 November 2019 and gives effect to the constitutional right to privacy of communications in Articles 31(c) and 31(d).

One more distinction matters. Whether a recording can be used as evidence in court is a separate question from whether recording it was lawful. Article 50(4) of the Constitution lets courts admit improperly obtained evidence after a balancing test, so a judge might still look at your recording. In Mbugua v Echo Network Africa (2024), an employer used a secretly recorded phone call to justify a termination, and the court held that private communications are confidential and require express consent. Winning admission of the recording does not protect you from an ODPC complaint about how it was made.

A recorded voice is personal data, and a voiceprint is biometric data

The Data Protection Act defines processing broadly enough to cover recording, storage, transcription, disclosure, and deletion. An audio recording that captures an identifiable person is personal data, full stop. That pulls every recorded call into the Act's requirements: a lawful basis for processing, a specified purpose, data minimization, storage limitation, and the data subject rights in section 26.

Consent under the Act has a specific meaning. Section 2 defines it as an "express, unequivocal, free, specific and informed indication" of the person's wishes, given "by a statement or by a clear affirmative action". Continuing to hold after a warning message is a weak version of this at best. The ODPC's Guidance Note on Consent, and enforcement commentary from Clyde & Co, confirm two points that should shape your design: consent must be specific to a stated purpose, and the burden of proving consent sits with you, the data controller. If your system cannot produce a consent record for a given call, assume you do not have consent for that call.

There is a second tier of sensitivity. If your agent verifies callers by their voice, section 2 classifies voice recognition as biometric data, which sits in the sensitive personal data category with stricter processing conditions. We covered the technical and cost trade-offs of that approach in Voice Biometrics for Call Center Authentication: Costs and Limits. The compliance takeaway here is simple: voiceprints raise the bar well beyond ordinary call recording, and you should treat them as a separate consent decision, not an add-on to a recording notice.

What the ODPC has actually done

The Office of the Data Protection Commissioner is not a paper regulator. As of 31 May 2025 it had received 7,611 complaints, resolved 7,497 of them, and issued 247 determinations, 112 enforcement notices, 19 penalty notices, and 134 compensation orders, according to the Kenya recording-law review at recordinglaw.com, which tracks the determinations. Three cases show how this applies to recording.

The most instructive is Andrew Alston v Liquid Telecommunications Kenya Ltd (ODPC Complaint No. 1125/2025, determined 4 February 2026). An HR representative recorded an exit-consultation call after the employee expressly refused consent. The recording was kept, and then transferred to the group's Mauritian sister company to be used in arbitration. The ODPC found violations of section 26(a), the right to be informed of the use of personal data, and section 40(1)(b), the right to erasure after the employee asked for deletion. The award was KES 700,000 in compensation plus an enforcement notice. One call, one refusal ignored, one failed deletion request.

The first major penalty notices, issued in September 2023, show the ceiling: a school was fined KES 4.55 million for publishing images of minors without parental consent, and a restaurant KES 1.85 million for posting a customer's image. The administrative fine cap is KES 5 million or 1 percent of annual turnover, whichever is lower, and general criminal exposure runs to a KES 3 million fine or ten years imprisonment. A 2025 CCTV case added KES 200,000 in compensation where a home camera captured a neighbor's property for nearly four years: the purpose, security, was legitimate, but the collection was disproportionate under section 25. The same proportionality logic applies to recording every second of every call when a transcript would do.

The compliance checklist before your agent records or places a call

This is the setup we scope into voice agent deployments, in the order the work happens.

1. Register with the ODPC. Registration is mandatory unless your annual turnover is below KES 5 million and you have fewer than 10 employees. Public bodies and non-profits must register regardless of size. Per the ODPC Personal Data Protection Handbook, fees are KES 4,000 for micro and small entities, KES 16,000 for medium, and KES 40,000 for large, with certificates valid for two years and typically issued within 14 days of a complete application.

2. Write down the purpose and lawful basis before writing any code. "Quality assurance and dispute resolution" is a purpose. "We record everything because we might want it" is not. The purpose drives retention, access controls, and what your disclosure script says.

3. Play a disclosure at the top of every call. Section 26(a) gives callers the right to be informed of the use their data will be put to. A working script is short: "This is an automated assistant for Company X. This call is recorded for quality and dispute resolution. If you do not want to be recorded, say agent or press 1 and we will connect you without recording." Notice it does two jobs: it announces the recording and it identifies the voice as an AI.

4. Capture consent as a loggable event. Store the consent artifact with the call: timestamp, call ID, the disclosure version played, and the caller's response. This is what discharges your burden of proof. A database row saying "consent assumed" is not evidence.

5. Build the kill switch and the deletion workflow. Refusal must stop recording in real time, not flag it for review. Erasure requests under section 40(1)(b) need a deletion path with confirmation to the requester. The Liquid Telecom award turned on exactly these two failures.

6. Set a retention schedule and automate deletion. Pick a window that matches the purpose, for example 90 days for quality assurance, and run a deletion job rather than relying on manual cleanup. Storage limitation is a stated principle of the Act.

7. Run a data protection impact assessment if you record at scale or use voiceprints. The ODPC expects a DPIA where processing is likely to result in high risk to data subjects, and always-on recording of customer calls plus biometric verification is comfortably in that territory.

8. Contract your processors and check where the audio goes. Your ASR, LLM, and text-to-speech vendors process personal data on your behalf, which makes them data processors and keeps you the controller. Know which country the audio and transcripts touch. Transfers out of Kenya require an adequacy finding from the ODPC or safeguards such as standard contractual clauses; the Kenya-EU adequacy dialogue opened in May 2024 but has produced no decision yet, so "it goes to an EU region" is not automatically a clean transfer. Breaches must be reported to the Data Commissioner within 72 hours.

Banks and insurers have sector obligations layered on top of this; we wrote about that intersection in Kenya Data Protection Act and AI in Banking and Insurance. For the telephony side of the build, see How to Connect Voice AI to Kenyan Phone Numbers: Setup and Costs.

The AI voice itself needs disclosure

Kenya has no enacted statute yet that forces a bot to introduce itself, but three signals point the same way, and waiting for the law to catch up is a poor design choice.

The transparency principle in section 25 of the DPA already obliges you to process personal data in a transparent manner, and a caller who believes they are speaking to a human is not giving informed consent to be recorded by an automated system. The Artificial Intelligence Bill 2026, before Parliament as Senate Bills No. 4 of 2025, would go further: it proposes to criminalize using AI to replicate a person's voice or likeness without consent, with penalties of KES 5 million or two years imprisonment, and to require labeling of AI-generated content.

Internationally the direction is explicit. Article 50 of the EU AI Act requires that people interacting with an AI system be informed of that fact, that synthetic audio be marked in machine-readable form, and that the disclosure happen at the latest at first interaction. If your operation calls EU numbers or sits inside a multinational, that obligation reaches you. In the US, the FCC ruled in February 2024 that AI-generated voices in robocalls are "artificial" under the Telephone Consumer Protection Act, requiring prior express consent, which matters for any Kenyan BPO dialing American consumers. The practical rule that satisfies all three regimes is the one already in the script above: the agent says it is an automated system in its first sentence, every time.

Worked example: a three-branch clinic group

Take a clinic group with three branches, 60 staff, and KES 20 million in annual turnover, deploying an AI receptionist that handles 400 calls a week at an average of four minutes.

• Registration: medium category, so KES 16,000 once, then KES 9,000 every two years. Budget a fortnight for the certificate.
• Audio volume: about 1,600 minutes of audio a week, roughly 83,000 minutes a year. Compressed at 32 kbps that is around 20 GB a year; transcripts are negligible beside it.
• Consent flow: the 12-second disclosure plays on every call. If 10 percent of callers decline recording, that is 40 calls a week that must land in an unrecorded queue, which is a staffing decision, not a software toggle.
• Retention: a 90-day quality-assurance window keeps roughly 5 GB live at any time. Object storage at that scale costs a few dollars a year; the real spend is engineering time for the consent log, the kill switch, and the scheduled deletion job.
• DPIA: recording every patient call at scale triggers the high-risk threshold, so a documented DPIA goes into the project plan alongside the telephony work.

The pattern to notice is that none of the hard parts are the AI. They are registration, provable consent, retention, and deletion, which are the same disciplines the ODPC has been enforcing since 2023.

Common mistakes that get businesses in trouble

• Disclosure without provable consent. Playing a message and logging nothing. The burden of proof is yours, and a played message with no recorded response is weak proof.
• An unlimited purpose. "Quality assurance" used to justify indefinite retention of full audio. Retention must match the stated purpose.
• Ignoring a refusal. Continuing to record after someone says no is the exact fact pattern behind the KES 700,000 award. The refusal path has to work in real time.
• Shipping audio abroad without checking. Sending recordings or transcripts to overseas APIs with no adequacy finding or contractual safeguards is an unlawful transfer even when the recording itself was lawful.
• Reusing recordings for training. Using recorded customer voices to train or clone a voice model is a new purpose requiring fresh, specific consent. Voice replication without consent is precisely what the AI Bill proposes to criminalize.
• Assuming the vendor carries the risk. Your ASR or telephony provider is a processor. The controller answering an ODPC complaint is you.

When recording is the wrong choice

Recording is not always the right default, even with perfect compliance plumbing.

Cold outbound prospecting is the clearest case: you have no relationship, consent rates are poor, and a recorded cold call that starts with a legal notice converts badly. Use an unrecorded introduction and book a follow-up. Where you only need the content of the conversation, live transcription with ephemeral audio satisfies data minimization better than permanent recordings; you keep the text you need and the audio never lands on disk. For payment moments, pause-and-resume recording or DTMF masking keeps card data out of your audio store entirely, which shrinks both your DPA exposure and your PCI scope. And in genuinely sensitive conversations, such as medical complaints or HR matters, the proportionality logic of the CCTV case suggests routing to a human with recording off is often the defensible choice.

Frequently asked questions

Is it legal for a business to record customer calls in Kenya? Yes, provided you have a lawful basis under the Data Protection Act, you inform callers at the start of the call, you collect for a specified purpose, and you honor refusals and deletion requests. The Act regulates recording rather than banning it.

Is playing a "this call may be recorded" message enough? It covers the duty to inform but is a weak form of consent on its own. The Act defines consent as an express, informed indication by statement or clear affirmative action, and you bear the burden of proving it. Log the disclosure played and the caller's response for every call.

Do these rules apply to AI voice bots? Yes. A recording made by your bot is processing done by you as the data controller, and every obligation above applies unchanged. Transparency norms additionally expect the bot to identify itself as an AI, which the EU AI Act already requires and Kenya's proposed AI Bill would reinforce.

What are the penalties for getting this wrong? Administrative fines run to KES 5 million or 1 percent of annual turnover, whichever is lower, plus compensation orders such as the KES 700,000 awarded over a single recorded call. Criminal exposure under the DPA reaches KES 3 million or ten years, and unlawful interception under the Cybercrimes Act reaches KES 10 million or five years.

Can call recordings be stored on servers outside Kenya? Only to jurisdictions the ODPC considers adequate, or under safeguards such as standard contractual clauses. The Kenya-EU adequacy dialogue opened in May 2024 but has not concluded, so check the transfer mechanism rather than assuming an EU or US region is fine.

Can we use recordings to train our own voice model? Not under a general recording consent. Training a model on customer voices is a new purpose that needs its own specific consent, and because voiceprints are biometric data, the threshold is higher. Replicating a person's voice without consent is what the AI Bill 2026 proposes to make a criminal offence.

Where to go from here

The compliance layer described here, registration, disclosure scripts, consent logging, kill switches, retention jobs, and DPIA documentation, is part of how we scope every voice deployment at AI Agents Plus, built on the open-source Hermes agent running Claude. If you are planning a voice agent for a Kenyan operation, our AI Employees service covers the build and the compliance plumbing around it, and our enterprise practice handles the governance documentation banks and insurers need on top. Talk to an engineer about your call flows before you switch recording on.