What Kenya’s Data Protection Act Means for NGOs and Researchers Handling Personal Data

If your organization surveys communities, runs beneficiary registers, tracks patients, or collects interview data, you handle personal data. In Kenya, that puts you under the Data Protection Act, 2019. For years, many NGOs and research teams treated compliance as a concern reserved primarily for banks and telcos. At T4D, we work closely with development and research partners across East Africa, and we can confirm that this is no longer a safe assumption.

Why This Law Now Matters to the Non-Profit Sector

The Act gives practical effect to the constitutional right to privacy, regulating how personal data is collected, processed, and protected while establishing core individual rights: the right to be informed, access records, object to processing, and request corrections or deletion.

Enforcement is actively taking place. Regulatory updates from AllAfrica highlight that the Office of the Data Protection Commissioner (ODPC) has already issued 184 compensation orders, 134 enforcement notices, and 20 penalty notices. The regulator has also tightened its stance on compliance deadlines: reporting by Capital FM noted that in August 2026, the ODPC gave controllers and processors with expired certificates until 11 September 2026 to regularize their registration status or face immediate enforcement action.

First, Know Your Role: Controller vs. Processor

The Act draws a clear distinction between two primary roles that every NGO and research team must identify within their operations:

• Data Controller: The organization that determines the why and how personal data is processed. For example, an NGO conducting a household survey to evaluate its own community programme acts as a controller.
• Data Processor: An organization that processes personal data strictly on behalf of a controller. A research firm contracted to collect and clean survey data for a donor-funded project operates as a processor.

Because your designated role dictates your exact legal obligations, defining this in project contracts is an essential first step.

Registration: The Obligation Most Organizations Miss

While not every entity in Kenya is subject to mandatory registration, non-profit organizations collecting personal data fall squarely in scope. According to news reports covered by the Kenya News Agency, the ODPC clarified that public, private, and non-profit entities processing personal data must register, with fees determined by organizational turnover and staff size.

Key legal considerations to keep in mind:

1. Mandatory Registration: As outlined in legal analyses by CMS Law, Section 18 of the Act stipulates that no entity may act as a controller or processor without holding a valid registration certificate from the Data Commissioner, subject to statutory thresholds.
2. Validity and Renewals: Registration certificates are valid for 24 months. Renewal fees are set at KES 2,000 for micro and small entities and KES 9,000 for medium-sized organizations.
3. Lapse Risks: Operating or continuing to process data with an expired certificate constitutes an offence under registration regulations. The ODPC strongly recommends initiating renewal applications at least 30 days prior to expiration.

Always check the official ODPC portal to confirm registration thresholds, verify fee structures, and check your renewal timelines.

The Principles Every Project Must Respect

The Act outlines foundational principles that must guide every data collection activity:

1. Lawful and Transparent: Participants must clearly know who you are, what data is being collected, and why.
2. Purpose Limitation: Data must only be used for its original stated objective. Information gathered for a community health survey should never quietly feed a secondary marketing or fundraising list.
3. Data Minimization: Keep survey forms concise. If a data point isn’t necessary for the project, remove the question.
4. Accuracy: Mechanisms must exist to allow individuals to correct inaccurate or outdated records.
5. Storage Limitation: Establish clear retention schedules to safely delete or anonymize data once project objectives are completed.
6. Security: Technical measures must protect devices, field servers, and shared cloud drives from unauthorized access.

Consent and Sensitive Data

Consent must be informed, specific, freely given, and easily revocable. For field researchers, this means delivering clear explanations in a language the participant fully understands, rather than collecting signatures on complex legal forms.

Extra safeguards apply to sensitive personal data, which includes health records, ethnic origin, social status, and sexual orientation. Because many NGO interventions focus on these exact categories, projects require tighter access controls and documented legal justifications. Similarly, collecting children’s data requires verified parental or guardian consent while demonstrating that processing directly serves the minor’s best interest.

Data Protection Impact Assessments (DPIAs)

When a project involves high-risk processing (such as large-scale health tracking, working with vulnerable populations, or deploying new technologies), the Act requires conducting a Data Protection Impact Assessment before fieldwork begins. A DPIA functions as a formal risk check, mapping out potential vulnerabilities and establishing mitigation protocols during the design phase when adjustments are easiest to make.

Data Breaches and the 72-Hour Window

If personal data is lost, stolen, or exposed (such as a lost field tablet containing unencrypted survey records), reporting obligations kick in immediately. According to compliance summaries on Hello Duty, the ODPC expects formal breach notifications within 72 hours of discovery. Every organization should maintain a simple incident response plan identifying who assesses the breach, who notifies the regulator, and how affected participants are informed.

Sharing Data with Donors, Partners, and Across Borders

International research partnerships and donor reporting frequently involve transferring datasets outside Kenya. The Act mandates specific safeguards before cross-border data transfers can occur, with even stricter limitations applied to sensitive datasets. Before uploading records to overseas servers or sharing files with global partners, verify the legal bases, technical safeguards, and participant consent terms.

A Practical Compliance Checklist

• Confirm ODPC registration requirements and schedule renewal dates.
• Conduct a data mapping exercise to identify where personal data resides and who has access.
• Define whether your organization is acting as a controller or processor for each project.
• Publish and update your organizational privacy notices and field consent scripts.
• Ensure field consent forms are available in local languages.
• Complete a DPIA for high-risk or large-scale data collection projects.
• Encrypt field devices, databases, and backup drives.
• Enforce data retention schedules to anonymize or delete datasets when projects close.
• Establish binding Data Processing Agreements (DPAs) with third-party vendors and research partners.
• Prepare a 72-hour breach response plan and train field staff on incident escalation.
• Determine if your processing operations require designating a Data Protection Officer (DPO).

Penalties and the Bigger Picture

Failing to comply with the Act can result in enforcement notices, compensation orders, and statutory fines. As highlighted by regulatory reviews on Hello Duty, maximum statutory penalties can reach up to KES 5 million.

Beyond financial fines, non-compliance carries severe reputational risks. Beneficiaries, donors, and local communities trust non-profits with sensitive information, and a single breach can undermine years of partnership. Handled proactively, strong data protection practices build participant trust, improve overall data quality, and strengthen funding proposals as international donors increasingly scrutinize data governance.

Building Capacity In-House

Achieving ongoing compliance relies on well-trained teams rather than static policy documents. Field staff, M&E officers, and programme managers need practical skills to apply data protection principles in their daily work, from secure data collection to managing participant consent. Teams looking to build this capacity in-house can look into structured options like our Complete Data Protection and Privacy Training Course, which offers tailored learning paths to help non-profit staff navigate Kenya’s evolving regulatory landscape effectively.

Disclaimer: This article provides general information and should not be taken as formal legal advice. For specific legal guidance regarding your organization’s compliance status, consult a qualified Kenyan data protection attorney or contact the ODPC directly.