Kenya Data Protection Act Compliance and When Self-Hosting Helps

If your business holds names, phone numbers, ID numbers, health records or payment details of people in Kenya, the Data Protection Act 2019 already applies to you, and most businesses of any size must also register with the Office of the Data Protection Commissioner (ODPC). The rules are concrete: registration fees in the thousands of shillings, a 72 hour breach reporting clock, and fines of up to KES 5 million or 1 percent of annual turnover, whichever is lower. This guide covers what the law actually demands from ordinary businesses, and gives an honest answer to a question we hear often: does self-hosting your software make compliance easier, or is that a distraction?

Who has to register with the ODPC, and what it costs

Section 18 of the Act, read with the Registration Regulations 2021, requires every public and private organisation, and individuals, that process personal data to register with the ODPC. The ODPC FAQ spells out the exemption and it is narrow:

• You are exempt only if your annual turnover is below KES 5 million and you have fewer than 10 employees. You must meet both conditions.
• Entire categories must register regardless of size. These include education, health administration and patient care, hospitality, financial services (which covers SACCOs), insurance, direct marketing, anyone running CCTV for crime prevention, property management, faith based institutions, betting, telecoms, transport and the public sector.

Read that list again if you think you are too small to bother. A six person clinic must register. A three person school must register. A two person shop that runs direct marketing campaigns must register. Size does not save you if your sector is listed.

Registration fees are tiered:

• Micro and small (1 to 50 employees, turnover up to KES 5 million): KES 4,000 to register, KES 2,000 to renew.
• Medium (51 to 99 employees, turnover KES 5 to 50 million): KES 16,000 to register, KES 9,000 to renew.
• Large (over 99 employees, turnover over KES 50 million): KES 40,000 to register, KES 25,000 to renew.

Two details trip people up. First, if you act as both a data controller and a data processor, that is two registrations and two fees. Second, the certificate lasts 24 months and must be renewed at least 30 days before expiry; changes to your particulars must be reported in writing within 14 days.

A worked example: a 60 person SACCO with KES 40 million in revenue sits squarely in the medium tier and pays KES 16,000 every two years, plus KES 9,000 at renewal. The money is trivial. The point of registration is that it puts you on the ODPC radar with a named contact, declared purposes of processing, and declared safeguards. Registration is the entry ticket, not the finish line.

The duties that apply every single day

Registration done, the substantive obligations begin. The full text of the Act sets out principles in section 25 (lawful purpose, minimality, accuracy, security, retention limits) and duties in section 26, including telling people what you are collecting and why. The Data Protection (General) Regulations 2021 turn these into operational requirements:

• A published data protection policy (regulation 23), updated regularly, covering what you collect, lawful purposes, how people exercise their rights, your complaints process, your retention periods, and any transfers outside Kenya.
• A written retention schedule (regulation 19) with time limits and periodic audits, and a duty to erase, anonymise or pseudonymise data once the purpose lapses. Keeping everything forever is itself a violation.
• Data subject rights with deadlines. Rectification requests are free, and a refusal must be explained in writing within seven days. Portability requests must be honoured within 30 days, and any fee may not exceed the actual cost. No fee may be charged for exercising rights requests in general.
• Direct marketing rules (regulations 15 to 18): every commercial message must carry a working opt out, and you must stop using or disclosing the data for marketing within seven days of a request.
• A data protection impact assessment before high risk processing (section 31). Regulation 49 lists the triggers: large scale processing, biometric or genetic data, sensitive personal data, data about children, systematic monitoring of public areas, and innovative uses of new technology. A school rolling out biometric attendance or a SACCO deploying a new credit scoring model should be doing a DPIA first.

On data protection officers, section 24 says a controller or processor may designate a DPO where it is a public or private body, where its core activities require regular and systematic monitoring of people, or where its core activities involve sensitive data such as health records. In practice, if you run a clinic, a school or a SACCO, treat a named, accountable privacy lead as expected rather than optional.

Your SaaS vendors are your data processors

Here is the part most SMEs miss. The ODPC FAQ states plainly that cloud computing providers storing personal data on your behalf, and CRM or ERP providers with access to personal data, are data processors. Your email marketing tool, your cloud CRM, your accounting SaaS, your WhatsApp support inbox: all processors.

Regulation 24 then requires a written contract with each processor containing specified terms: the subject matter and duration of processing, your instructions, confidentiality commitments, security measures, a requirement that data be deleted or returned when the contract ends, and audit and inspection rights for you. Regulation 25 adds that your processor may not bring in a third party sub-processor without your authorisation, and remains liable to you for that third party.

A vendor click-through agreement is not automatically this contract. For each tool holding personal data, you should be able to answer: where is the data hosted, who are the sub-processors, what happens to the data when we leave, and can we audit? If you cannot answer, that is a compliance gap sitting in your stack right now. This is one reason businesses compare the real cost of tools like Twenty CRM against HubSpot: the sticker price is only part of the decision when processor obligations come with the subscription.

Breaches: the 72 hour clock

Section 43 of the Act is short and unforgiving. Where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the data subject, the controller must:

• Notify the Data Commissioner without delay, within 72 hours of becoming aware of the breach.
• Communicate to the affected data subject in writing within a reasonably practical period, unless the person cannot be identified.

A notification made after 72 hours must be accompanied by reasons for the delay. And if the breach happens at your processor, the processor must notify you without delay, within 48 hours where practicable. That 48 hour handoff is why your vendor contract matters so much: if your SaaS provider sits on a breach for two weeks, your 72 hour clock starts when you find out, but your customers and the ODPC will ask why your contract allowed that.

Regulation 37 defines which breaches are notifiable (ID numbers combined with sensitive data, and account credentials among them), and regulation 38 specifies what your notification to the ODPC must contain: when and how you became aware, a chronological account of steps taken, the number of people affected, the classes of data involved, potential harm, and your mitigation measures.

Every business above the registration threshold should have a one page breach runbook: who declares an incident, who drafts the notification, which ODPC channel it goes to, and a template letter to affected customers. Write it before you need it.

Cross border transfers and data residency

Kenya does not ban storing data abroad, but section 48 puts the burden on you. You may transfer personal data out of Kenya only where you have given the Data Commissioner proof of appropriate safeguards (including that the destination has commensurate data protection laws), where the transfer is necessary for a contract with the data subject, a matter of public interest, a legal claim, or vital interests, or, under section 49 and regulation 46 for sensitive data, where the person explicitly consented after being told the risks. Transfers made on the basis of safeguards must be documented, and the documentation must be produced to the Commissioner on request. Regulation 42 adds a useful shortcut: a destination country is deemed to have appropriate safeguards if it has ratified the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention), has a reciprocal agreement with Kenya, or is covered by binding corporate rules.

Then there is actual data localisation. Regulation 26 requires that personal data processed for purposes of strategic interest of the state be processed through a server and data centre located in Kenya, or that at least one serving copy be stored in a Kenyan data centre. The listed purposes include civil registration, elections, public finances, protected computer systems, early childhood and basic education, and primary or secondary health care.

If you run a school or a clinic, read that again. The systems holding your core student or patient records have a statutory preference for Kenyan infrastructure. A US hosted school management system is not per se illegal, but you are carrying a proof burden and possibly a localisation problem that a Kenyan hosted alternative simply does not have.

What enforcement looks like

The Act gives the Data Commissioner real teeth, in two modes:

• Enforcement notices (section 58) order you to fix a contravention within at least 21 days. Failing to comply without reasonable excuse is a criminal offence: a fine of up to KES 5 million, up to two years in prison, or both.
• Penalty notices (section 62) impose administrative fines directly. Section 63 caps these at KES 5 million or, for a business, 1 percent of annual turnover of the preceding financial year, whichever is lower.

Note the direction of that cap: whichever is lower, not higher. The drafters were calibrating for deterrence at SME scale, not writing headline numbers for multinationals. On top of fines, section 65 lets data subjects sue for compensation for damage suffered, and section 64 routes appeals to the High Court. The ODPC publishes its determinations in individual complaints on its website, for example its 2023 determination in Wanjiku v Casa Vera Lounge, a complaint arising from a lounge posting a reveller's image without consent. This is not theoretical enforcement aimed at banks. Ordinary hospitality businesses end up in published determinations.

Where self-hosting genuinely helps

Self-hosting means running your software, such as an open source CRM, helpdesk or mailing system, on infrastructure you control, whether a Kenyan cloud region, a local VPS provider or your own servers. Mapped against the duties above, it moves real needles:

• Data residency becomes an architecture fact, not a promise. If regulation 26 or your own risk appetite points at Kenyan hosting, deploying on Kenyan infrastructure satisfies it by construction. No vendor attestations, no wondering which region your data actually replicates to.
• Deletion and exit are verifiable. Regulation 24 requires that processors delete or return data at the end of a contract. With your own database, you run the DELETE statement and you hold the backups. You are not trusting a certification email from a vendor's support queue.
• No hidden sub-processor chains. Regulation 25's authorisation requirement is automatically satisfied when there is no chain: your stack, your keys, your logs.
• Audit rights are real. You have root access. When the ODPC or your own auditor asks who accessed a record in March, you query your own logs instead of filing a vendor ticket.
• The 48 hour processor handoff disappears. When you are both controller and operator, there is no waiting for a vendor's disclosure email to start your 72 hour clock. Your own monitoring tells you first.

There is also a marketing data angle. Moving your mailing list to a self-hosted sender means the list, the consent records and the opt out handling all sit under your control; our guide on migrating from Mailchimp to self-hosted Listmonk walks through the mechanics. The same logic applies to customer support histories, which are dense with personal data; see migrating from Zendesk to self-hosted Chatwoot. Even your analytics choice feeds the same question of who else touches visitor data, which we compared in Plausible vs Google Analytics.

Where self-hosting changes nothing

Be honest with yourself here, because the ODPC will be:

• Registration, policies and paperwork are untouched. You still register, still publish a data protection policy, still write the retention schedule, still do DPIAs. Zero of that is affected by where your server sits.
• Data subject rights still need a process. A portability request does not answer itself because you own the database. Someone still has to respond within 30 days.
• The 72 hour breach duty still applies to you. Self-hosting removes the vendor handoff but makes you solely responsible for even detecting the breach. An unmonitored self-hosted box fails this harder than a competent SaaS.
• Security becomes entirely your job. Section 25 requires security safeguards, and regulation 32 expects audit trails, access controls, backups and routine vulnerability testing. A misconfigured, unpatched self-hosted CRM exposed to the internet is not a compliance win; it is a breach announcement waiting for a date.

So when is self-hosting the wrong choice? When you have no one, internal or contracted, who will patch, back up and monitor the system every week. When the data is low sensitivity and your vendor already offers a strong data processing agreement with regional hosting. When the team is five people and the honest capacity for systems administration is zero. In those cases a well chosen SaaS with a proper regulation 24 contract beats a neglected server.

A practical compliance sequence for an SME

In order of effort and impact:

1. Map your data. One spreadsheet: what personal data you hold, whose, why, where it lives, who can access it, how long you keep it.
2. Register with the ODPC (or document why both exemption conditions apply). Budget KES 4,000 to 40,000 depending on tier.
3. Publish your data protection policy and your privacy notice, following regulation 23.
4. Write the retention schedule and actually delete on schedule (regulation 19).
5. Audit your vendor stack. For every processor, get a written contract with regulation 24 terms, or plan the exit.
6. Fix your marketing flows. Consent captured, opt out in every message, seven day suppression honoured.
7. Set up a rights request procedure with the regulation deadlines: seven days for refusal notices, 30 days for portability.
8. Do DPIAs before high risk projects, especially biometrics, children's data, health data or new scoring systems.
9. Write the breach runbook covering section 43 and regulation 38 content requirements.
10. Decide hosting per workload. Kenyan or self-hosted infrastructure for regulated, sensitive or localisation covered data; reputable SaaS with a proper contract for the rest.

Common mistakes

• Assuming small means exempt. The exemption needs both conditions, and the sector list (health, education, finance, marketing, hospitality) overrides size entirely.
• Treating the certificate as compliance. Registration is step one of ten, not the job.
• No processor contracts. Your CRM vendor's terms of service are not the written contract regulation 24 describes, unless they contain the specified terms.
• Marketing lists with broken opt outs. Regulation 16 requires a working opt out in each message; regulation 18 gives you seven days to honour one.
• Keeping data forever. Without a retention schedule and actual deletion, you are accumulating liability, not an asset.
• Believing the cloud vendor handles compliance. The vendor is your processor. The obligations are yours.
• Buying Kenyan hosting and stopping there. Residency solves residency. The other nine steps remain.

Frequently asked questions

Does the Data Protection Act apply to a small business? Yes. The Act applies to any organisation processing personal data of people in Kenya. Registration is only skipped if your turnover is under KES 5 million and you have fewer than 10 employees, and whole sectors including health, education, financial services and direct marketing must register regardless of size.

How much does ODPC registration cost? KES 4,000 for micro and small organisations, KES 16,000 for medium, and KES 40,000 for large ones, with renewals at KES 2,000, 9,000 and 25,000 respectively. The certificate is valid for 24 months. Public entities, charities and religious bodies pay the lowest tier regardless of size.

Is it illegal to store customer data outside Kenya? Generally no, but section 48 requires proof of appropriate safeguards, a necessity ground, or explicit consent for sensitive data, and you must document the transfer. For specific purposes, including basic education and primary or secondary health care, regulation 26 requires processing through servers in Kenya or keeping at least one serving copy in a Kenyan data centre.

What is the maximum fine under the Act? Administrative penalty notices are capped at KES 5 million or 1 percent of prior year turnover, whichever is lower. Separately, criminal offences such as ignoring an enforcement notice carry fines up to KES 5 million, up to two years imprisonment, or both, and affected individuals can sue for compensation.

Do I need a data protection officer? Section 24 frames appointment of a DPO as available to any public or private body, and it is expected where your core activities involve regular and systematic monitoring of people or processing sensitive data. Clinics, schools and SACCOs should treat a named privacy lead as necessary.

Is self-hosting enough for compliance? No. Self-hosting helps with residency, deletion verification, audit access and sub-processor control, but registration, policies, retention, rights handling, DPIAs and breach notification all remain your responsibility either way.

Where to go from here

If the vendor audit in step five left you staring at a stack of processors you cannot get straight answers from, the fix is usually architectural: move the systems that hold the most personal data onto infrastructure you control, and keep SaaS only where its contract and hosting stand up. Our managed open source stack service deploys and runs exactly that, Twenty, Chatwoot, Listmonk, Plausible and the rest, on infrastructure you choose, with the patching, backups and monitoring handled. For law firms weighing the same questions around client confidential data, our Claude for Legal practice covers private deployment and governance. Either way, start with the data map and the registration; everything else follows from those two.