Data Residency in Kenya: What the ODPC Enforcement Turn Means for Your Business

For several years after the Data Protection Act No. 24 of 2019 came into force, compliance in Kenya was mostly about registration, privacy policies and awareness. That has changed. The Office of the Data Protection Commissioner now runs compliance audits, investigates complaints, issues enforcement notices and orders companies to compensate affected individuals.

As a result, a question that used to sit with the IT team has become a compliance question: where does your customer data actually live, who can access it, and does it leave the country?

In this article, we give a practical Kenya Data Protection Act 2019 summary for businesses, explain what data residency and data localization mean under Kenyan law, look at how the ODPC enforces the Act, and walk through how to assess and choose cloud infrastructure that keeps your data residency setup simple and defensible.

This article is for general information and is not legal advice. For the interpretation of the Act in your specific case, consult qualified legal counsel.

Kenya Data Protection Act 2019: a summary of what businesses need to know

What is the Data Protection Act 2019?

The Kenya Data Protection Act 2019 (DPA 2019) is the country’s main personal data protection law. Parliament adopted it to give effect to the right to privacy under Article 31 of the Constitution, and it came into force on 25 November 2019. With it, Kenya adopted comprehensive data protection rules that are close in spirit to the EU’s GDPR.

The Act is supported by three sets of regulations issued in 2021: the General Regulations, the Registration Regulations, and the Complaints Handling Procedure and Enforcement Regulations. Together, they turn general principles into concrete operational duties.

The core principles every organization must follow include:

• Lawful processing. Personal data must be processed lawfully, fairly and transparently, on a valid legal basis such as consent, contract or legal obligation.
• Purpose limitation. Data is collected for explicit, specified purposes and not reused for unrelated ones.
• Data minimization. Only the data that is necessary for the purpose is collected.
• Data retention. Data is kept no longer than necessary and then deleted or anonymized.
• Security. Data must be protected with appropriate technical and organizational measures.
• Transfers. Personal data should not be transferred outside Kenya without proof of adequate safeguards or the data subject’s consent.

The Act also gives every data subject a set of data subject rights: to be informed, to access their data, to object to processing, to have data corrected or deleted, and to data portability. In practice, this means a clear privacy notice, a working process for handling requests, and the ability to actually find and delete a person’s data across your systems.

Two further obligations matter for infrastructure. A data breach that poses a risk to individuals must be reported to the Data Commissioner within 72 hours of becoming aware of it. And high-risk processing, such as large-scale processing of sensitive personal data, requires a data protection impact assessment (DPIA) before it starts.

Who does the DPA apply to?

The Data Protection Act Kenya applies to two types of organizations:

• A data controller decides why and how personal data is processed. For example, a bank, a hospital, an online store or a mobile app.
• A data processor processes personal data on behalf of a controller. For example, a payroll provider, a call center or a cloud provider hosting your systems.

The Act applies to controllers and processors established or resident in Kenya. It also applies to organizations outside Kenya that process personal data of people located in Kenya. A foreign company serving Kenyan customers is in scope even if it has no local office.

Many organizations must also register with the ODPC. Registration is mandatory above set turnover and staff thresholds, and for certain sectors regardless of size, including healthcare, education, financial services and telecommunications.

An organization may also appoint a Data Protection Officer to advise on compliance and act as a contact point for the regulator. This is especially relevant where core activities involve large-scale processing of sensitive data or regular monitoring of individuals.

What is the role of the ODPC?

The Office of the Data Protection Commissioner (ODPC) is the government body that oversees the implementation of the Act. It is headed by the Data Commissioner and is designed to operate independently in its regulatory functions.

The ODPC is empowered to:

• register data controllers and data processors;
• receive and investigate complaints from data subjects;
• carry out inspections and compliance audits;
• issue guidance notes and promote public awareness;
• issue enforcement notices, penalty notices and compensation orders.

What data residency means under the Data Protection Act Kenya 2019

Data residency vs. data localization

These terms are often used interchangeably, but they mean different things:

In short, Kenyan law does not ban storing personal data abroad. But it attaches conditions to every international data transfer, and for a narrow set of data it requires a local copy.

Which data must be processed or stored in Kenya

Section 50 of the Act allows the government to require that certain processing happens in Kenya on grounds of strategic interest of the state. Regulation 26 of the Data Protection (General) Regulations, 2021 makes this concrete.

Where personal data is processed for these purposes, the processing must either run through a server and data centre located in Kenya, or at least one serving copy of the data must be stored in a data centre in Kenya. The purposes include, among others:

• civil registration and legal identity;
• the electoral process;
• public finance and revenue systems;
• protected computer systems and critical infrastructure;
• early childhood and basic education;
• primary and secondary health care.

This matters not only for government agencies. Private companies that build or operate systems for these purposes, such as health-tech platforms, education platforms or vendors serving public institutions, also need to check whether their data falls in scope.

When personal data can be transferred outside Kenya

For all other personal data, a cross-border data transfer is allowed, but only on a recognized legal basis. The main routes are:

• Appropriate safeguards. The data controller gives the ODPC proof that the data will be adequately protected abroad. This is usually done through a legally binding data transfer agreement, standard contractual clauses or binding corporate rules within a group of companies.
• Adequacy decision. The transfer goes to a country or organization the Data Commissioner recognizes as offering an adequate level of protection. Until such a list is published, a company cannot simply assume a destination is adequate.
• Necessity. The transfer is necessary, for example, to perform a contract with the data subject or for important public interest reasons.
• Consent. The data subject has given consent after being informed of the possible risks.

Sensitive personal data, such as health, biometric or genetic data, has a stricter rule. It can be transferred abroad only with the data subject’s consent and on confirmation of appropriate safeguards.

The ODPC has also made its expectations much more specific. On 8 September 2026, it published the final Guidance Notes for Cross-border Data Transfers, following a public consultation on a draft released in April. The guidance includes standard clauses for controller-to-controller and controller-to-processor transfers. Before relying on them, the parties must assess and document the risks of the transfer, including the laws of the destination country. Onward transfers need prior written authorization, and the recipient may not use the data for its own purposes, such as analytics, product improvement or marketing. Companies must also keep records of their transfers, including the recipient, the justification and a description of the data.

The guidance also confirms a point that is easy to miss: a transfer is not only sending data abroad. Giving a recipient outside Kenya access to data also counts, and processing personal data in a cloud environment with servers outside Kenya is expressly treated as a cross-border transfer.

Hosting abroad is not banned. The guidance even accepts that a compelling legitimate interest, such as operational efficiency, can justify hosting data on foreign cloud servers in some cases. But each such transfer still needs a documented legal basis, a risk assessment and transfer records, and sensitive personal data still requires the data subject’s consent. If your application, backups or support teams sit in another country, this paperwork applies to you.

What the ODPC enforcement trend means for businesses

In a January 2026 review, PwC Kenya noted that companies should now prepare for closer regulatory oversight, more developed audit practices and stricter accountability when privacy goes wrong. For most companies, this is less about fear of fines and more about being able to show, with evidence, how personal data is handled.

What powers does the ODPC have?

The Data Protection Commissioner can open investigations on its own initiative or following a complaint, request information and documents, and inspect how data is processed. The Data Protection (Conduct of Compliance Audit) Regulations, 2024 set out the procedure for compliance audits, including the documents an organization must produce.

In practice, auditors look for evidence such as:

• a register of processing activities and a map of data flows;
• DPIAs for high-risk processing;
• consent records and privacy notices;
• contracts with data processors and cloud providers;
• records of cross-border transfers and the safeguards behind them;
• a data breach register and records of how incidents were handled;
• retention schedules and evidence that data is actually deleted.

Investigations and enforcement notices

Most enforcement starts with a complaint. Public awareness has grown quickly, and so has the number of people contacting the regulator. According to figures compiled by Sentinel Assurance Partners in April 2026, the ODPC has received more than 9,000 complaints since the Act came into force, and has issued 184 compensation orders, 134 enforcement notices and 20 penalty notices.

An enforcement notice tells an organization what it must fix and by when. If it does not comply, the ODPC can move to a penalty notice. The regulator can also order a company to pay compensation to the affected person, so the cost of a breach is no longer only reputational.

Courts have reinforced this trend. In May 2025, the High Court ordered Worldcoin to delete biometric data collected from Kenyans, after finding that it had been collected without a valid DPIA and without proper consent. In January 2026, the ODPC confirmed that the data had been deleted. In a separate case, the court halted a facial recognition attendance system at the Kenya Broadcasting Corporation, again over consent and the lack of a DPIA.

Administrative fines and corrective measures

Under the current Act, the ODPC can impose an administrative fine of up to KES 5 million or 1% of the organization’s annual turnover for the preceding financial year, whichever is lower. Besides fines, the regulator can order an organization to stop or change processing, delete data and compensate data subjects. Some breaches are criminal offences and can lead to fines or imprisonment.

The legal framework may also tighten. A draft Data Protection (Amendment) Bill, 2025, prepared by the Data Privacy and Governance Society of Kenya, proposes, among other things, to raise the maximum financial exposure and to create a Data Protection Appeals Tribunal. It is a proposal, not law, but it shows the direction of the discussion.

Why cloud and data-location decisions matter for compliance

Many of the questions an auditor asks come down to infrastructure: where the data is stored, where it is processed, who has access, where backups are kept and how data is deleted at the end of its retention period.

If your systems run in a data centre in Kenya, a large part of these answers becomes simple. There is no international data transfer to document for your primary workloads, no foreign adequacy question to answer, and no separate safeguards to prove for each destination. If your systems run abroad, each of these points needs its own paperwork, contracts and records, and every new vendor or backup location adds another transfer to manage.

Which businesses should pay particular attention?

The DPA 2019 applies to almost every organization that handles personal data. But some sectors combine large volumes of customer data, sensitive data or complex cross-border setups, which makes data location a more pressing issue.

Financial services and fintech

Banks, digital lenders, payment providers and insurers process identity documents, financial records and transaction histories at scale. Fintech companies often also rely on credit scoring, fraud detection and other automated decisions. Many of them already work under PCI DSS and sector regulators, so data protection requirements add to an existing compliance load.

Healthcare

Health data is sensitive personal data under the Act. It needs a stronger legal basis, stricter access control and, for transfers abroad, the patient’s consent. Primary and secondary health care is also on the list of purposes that require processing or a serving copy in Kenya.

Telecommunications

Telecom operators handle subscriber registration data, location data and communication metadata for millions of people. This scale makes them a natural focus for regulators.

E-commerce and consumer platforms

Online stores, delivery apps and marketplaces collect names, phone numbers, addresses and payment details, and often use them for marketing. Marketing without valid consent has been a recurring enforcement theme, and many retailers have had to rework their consent and SMS marketing practices.

SaaS and technology companies

SaaS providers usually act as data processors for their business customers. Those customers increasingly ask where their data is hosted and request a data processing agreement that reflects Kenyan requirements. For SaaS companies, local hosting can become a sales argument as well as a compliance measure.

Businesses using international cloud providers

Any company whose applications, databases or backups run outside Kenya is making cross-border data transfers, even if all its customers and staff are in Kenya. This is common in enterprise IT and among startups that launched on global cloud platforms. These businesses need a documented legal basis for each transfer, or a plan to bring the data closer to home.

How to assess your current data residency setup

Before choosing new infrastructure, it helps to understand where your data is today. A practical review can follow six steps. It works best as a joint exercise of the IT team, the data protection officer and legal advisers.

1. Map where personal data is collected. List every entry point: websites, mobile apps, CRM, call centers, payment flows, HR systems, CCTV and access control. For each, note what categories of data are collected, including any sensitive personal data, and on what legal basis.
2. Identify where data is stored. For each system, find the physical location of the databases, file storage and object storage. “In the cloud” is not an answer: you need the provider, the region and the country.
3. Identify where data is processed. Processing and storage are not always in the same place. Analytics pipelines, AI services, email platforms and monitoring tools may process the same customer data somewhere else.
4. Map third-party and cloud providers. List every data processor and sub-processor: hosting, SaaS tools, payment gateways, support desks, marketing platforms. Check that each one has a data processing agreement and that you know where it operates.
5. Identify cross-border data transfers. Combine the results of the previous steps. Every flow that leaves Kenya, including remote access by staff or vendors abroad, needs a legal basis and a record. Flag flows that involve sensitive personal data or purposes covered by the localization rules.
6. Check backup and disaster recovery locations. Backups are personal data too. A system hosted in Nairobi with nightly backups to another continent still makes a cross-border transfer. Check the location of snapshots, replicas, archives and disaster recovery sites.

The result is a clear picture of which flows already meet the requirements, which need contracts and transfer records, and which would be simpler to move to infrastructure in Kenya.

How to choose cloud infrastructure for Kenya data residency

If the assessment shows that some workloads should move to Kenya, the next step is choosing a cloud provider. Below are the criteria that matter most for data protection, and the questions worth asking any provider.

Two more points are worth keeping in mind. 

First, a provider’s certifications, such as ISO 27001 or PCI DSS, do not make you compliant on their own, but they give you independent evidence of the provider’s controls to show an auditor. 

Second, cloud security follows a shared responsibility model. The provider secures the data centre, hardware and network, while you remain the data controller and are responsible for your data, applications and how you configure access. Make sure your contract with the provider reflects this, including its role as a data processor.

Kenya data residency with Servercore

Servercore runs an availability zone in Nairobi, hosted in the iColo data centre. The facility holds the Uptime Institute Tier III Design certification, and its information security management system is certified to ISO 27001. Servercore itself is certified to PCI DSS, so the infrastructure can also host systems that process payment card data.

This means you can keep both your primary workloads and their supporting services in Kenya, without building or running your own server room.

Dedicated and cloud infrastructure options

In the Nairobi region, you can choose the type of infrastructure that fits each workload:

• Cloud servers (VPS). Virtual machines with fixed or custom configurations that scale in minutes. A good fit for web applications, APIs and workloads with changing traffic.
• Dedicated servers. Physical servers whose resources belong to you alone. Suitable for steady, resource-heavy workloads and for cases where you want full isolation of sensitive data at the hardware level.
• Cloud databases. Managed databases where Servercore handles installation, updates and maintenance, so your team can focus on the data model and queries.
• Managed Kubernetes. Managed clusters for containerized applications, with automatic node recovery and management through API and Terraform.

For example, the ERP-POS provider Uzapoint moved its infrastructure from a foreign cloud to servers in Nairobi, in part to meet the Data Protection Act’s requirements for storing and processing personal data. As a result, latency dropped 100-fold and infrastructure costs fell by 60%.

Private networks and isolated environments

Servercore provides three types of networks: internet, local network and the private network of the Global Router. They are isolated from each other, so traffic in one does not affect the others. The Global Router connects cloud servers, dedicated servers, databases and Kubernetes clusters into one private network free of charge, with unlimited traffic within a region. Data moving between your services in Nairobi does not need to cross the public internet. All projects are also protected against DDoS attacks at no extra cost.

Backup and storage architecture

Data on cloud servers is stored in a fault-tolerant cluster of network disks, where every block is kept in three copies on different servers in different racks. The cloud backup service is available in the Kenya region and stores backups separately from the source disks, in a different cluster within the same pool. This means backups of your servers in Nairobi stay in Kenya together with the primary data, with no cross-border transfer involved. Scheduled backups cover network drives; for local disks, you can use disk images.

Security controls and access management

• Access management. The IAM service lets you control who in your team can access which resources and with which permissions.
• Encryption and authentication. Traffic between users and Servercore web services is encrypted, and two-factor authentication is available. Our documentation explains how to encrypt data on Linux servers and in PostgreSQL databases.
• Security event logging. You can record security events in the cloud, the control panel and Managed Kubernetes, which helps both with incident response and with audit evidence.
• Restricted staff access. Servercore employees can access customer data only after approval through an internal system.
• Data deletion. When you stop using a product, customer data is deleted. In the cloud environment, this process is automated.

On top of that, Servercore offers free migration, billing in Kenyan shillings with M-Pesa and card payments, and 24/7 technical support. As with any provider, you remain the data controller: we secure the facility, hardware and network, and you decide what data you process and who can access it.

Learn more about our certifications and how we protect data on the Servercore Solutions Security page.

Frequently asked questions

What is the Kenya Data Protection Act 2019?

It is Kenya’s main data protection law. It sets out principles for processing personal data, the rights of data subjects, the obligations of data controllers and processors, rules for cross-border transfers, and the powers of the ODPC. It came into force on 25 November 2019.

What is data residency in Kenya?

Data residency means that personal data is physically stored and processed in Kenya. For most data, it is a choice rather than a legal requirement, but it removes the need to justify and document cross-border transfers.

Can Kenyan personal data be stored outside Kenya?

Yes, in most cases. The transfer needs a legal basis, such as appropriate safeguards, an adequacy decision, necessity or the data subject’s consent. Sensitive personal data requires consent and appropriate safeguards. Data processed for the strategic interests of the state must be processed in Kenya, or at least one serving copy must be kept in a data centre in Kenya.

What is the difference between data residency and data localization?

Data residency describes where data is located, usually by choice. Data localization is a legal obligation to keep certain data in the country. In Kenya, localization applies to a limited set of purposes, while data residency is a practical way to simplify compliance for everything else.

Who regulates data protection in Kenya?

The Office of the Data Protection Commissioner (ODPC), headed by the Data Commissioner. It registers controllers and processors, handles complaints, runs audits and enforces the Act. Courts also play a role, as recent rulings on biometric data show.

What are the penalties under the Kenya DPA?

The ODPC can impose administrative fines of up to KES 5 million or 1% of annual turnover, whichever is lower. It can also issue enforcement notices, order data deletion and require compensation for affected individuals. Some violations are criminal offences.

How can a business prepare for an ODPC investigation?

Keep your records current: a register of processing activities, DPIAs, privacy notices, consent records, contracts with processors, transfer records and a data breach register. Know where your data is stored and processed, including backups. And make sure you can show how data is secured, who can access it and how it is deleted when no longer needed.

Conclusion

The Data Protection Act 2019 Kenya has moved from paper to practice. The ODPC audits, investigates and orders compensation, and businesses are expected to show, not just state, how they protect personal data.

Where your data lives is one of the simplest variables you control. Keeping customer data, processing and backups in Kenya removes an entire category of documentation and risk, and lets your team focus on the rest of the compliance work.

If you want to review your current setup or plan a move to infrastructure in Nairobi, write to us at hello@servercore.com. Our team will help you choose the right configuration and migrate your workloads free of charge.