Time flies with great content! Renew in to keep enjoying all our premium content.
Prime
What tougher data protection oversight means for business
Audits may be triggered by complaints, regulatory investigations, risk assessments indicating non compliance, data breach notifications, or direct initiation by the ODPC.
The data protection and privacy landscape in Kenya has evolved significantly since the enactment of the Kenya Data Protection Act, Cap 411C (Laws of Kenya), in 2019. As the country enters a more assertive enforcement phase in 2026, organisations should expect more structured regulatory scrutiny, more mature audit practices, and heightened accountability for failures in data governance and privacy compliance.
This shift mirrors a broader continental movement toward harmonised data protection standards, reflected in rising public awareness driven by national sensitisation initiatives led by the Office of the Data Protection Commissioner (ODPC) and a growing number of complaints lodged directly with the regulator.
