Data Protection Act, 2019

Section 4 applies the Act to a data controller or processor established or ordinarily resident in Kenya and processing personal data while in Kenya, and — extraterritorially — to one not established or ordinarily resident in Kenya but processing the personal data of data subjects located in Kenya. That second limb is a plain territorial-subject test, so a foreign business handling Kenyan users' data is in scope without any local entity. The Office of the Data Protection Commissioner has been among the more active African regulators, with a mandatory registration regime for controllers and processors above specified thresholds, breach notification within 72 hours, data-protection impact assessments, and published enforcement decisions including monetary penalties. Cross-border transfers require an appropriate safeguard or a specified condition, and certain categories of data are subject to localization requirements under sector rules.