Kenya's Data Protection Act: What It Means for Your Website

Almost every business website collects personal data: names and phone numbers in contact forms, delivery addresses in online orders, email addresses in newsletters and browsing data through analytics. Kenya's Data Protection Act, 2019 sets rules for how that data must be handled. This guide explains what it means for your website in plain language. It is general information, not legal advice.

What counts as personal data on a website?

• Names, phone numbers and email addresses from forms.
• Delivery addresses and order histories.
• Account logins and profile information.
• IP addresses, device identifiers and analytics data.
• Uploaded documents such as CVs, IDs or medical forms.
• Sensitive data such as health information, which needs extra care.

Which principles apply?

The Act sets principles similar to other modern data protection laws: process data lawfully, fairly and transparently; collect it for specific purposes; collect only what is necessary; keep it accurate; keep it no longer than needed; and protect it with appropriate security.

What should your website do?

Requirement	On your website
Transparency	A clear privacy policy explaining what data you collect, why, who receives it and for how long
Data minimisation	Forms that ask only for what you need
Consent where required	Clear opt-in for marketing messages; no pre-ticked boxes
Security	HTTPS, secure hosting, access controls, updates and backups
Data subject rights	A way to request access, correction or deletion
Third parties	Disclose analytics, payment, email and AI providers that process data

What should a privacy policy include?

1. Who you are and how to contact you about privacy.
2. What personal data you collect and how.
3. Why you use it and the legal basis.
4. Who you share it with, including service providers.
5. Whether data is transferred outside Kenya.
6. How long you keep it.
7. How it is protected.
8. People's rights and how to exercise them.

Write it in plain language and keep it accurate as your website and tools change.

Do you need to register with the ODPC?

The Office of the Data Protection Commissioner registers data controllers and processors. Whether registration is mandatory depends on factors such as your sector, size and the type of data you handle. Check the ODPC's current guidance and thresholds for your business.

What about cookies and analytics?

Analytics and advertising tools use cookies and similar technologies that process personal data. Explain them in your privacy policy, configure analytics to minimise data, for example by anonymising IP addresses where possible, and consider a consent banner, especially if you use advertising cookies or serve visitors from regions with strict consent rules.

What should you do if there is a data breach?

A breach, such as a hacked database or leaked form submissions, may need to be reported to the ODPC and, in some cases, to affected people within set timeframes. Prepare a simple response plan: who investigates, who decides on notification and how to contain the damage. Strong security and regular updates reduce the risk. Read what to do if your website is hacked.

Which website features need extra care?

• Patient, student or member portals.
• Uploads of identity documents or CVs.
• AI chat assistants that may receive personal information.
• Payment and order data.
• Marketing lists and automated messages.

A quick website privacy checklist

• Clear, current privacy policy linked in the footer and near forms.
• Forms ask only for necessary information.
• Marketing opt-in is separate and not pre-ticked.
• HTTPS everywhere, secure hosting and restricted admin access.
• A process for access, correction and deletion requests.
• A data retention schedule for form submissions and uploads.
• A breach response plan.

Example: tidying up a contact form

A company's quote form asked for ID numbers and dates of birth it never used, stored submissions indefinitely in an email inbox and had no privacy notice. It removed the unnecessary fields, added a short privacy notice with a link to its policy, moved submissions into a secure system with restricted access and set submissions to be deleted after a defined period. The form became shorter, safer and better at converting.

Build privacy into your website

Our website design and maintenance teams build secure forms, privacy-friendly analytics and data retention into websites. Read also cybersecurity basics for Kenyan SMEs.

This article is general information, not legal advice. Consult a qualified adviser and the ODPC's current guidance for your obligations.