Mumbua runs an insurance agency in Westlands. Her website collected names, phone numbers and ID numbers through a quote form. One day a corporate client’s HR manager asked: “How does your website store our staff’s data?” Mumbua did not know. Her privacy policy had been copied from a European website years ago.
The short answer
- Kenya’s Data Protection Act, 2019 applies to any website that collects personal data from people in Kenya, including contact forms.
- You need a privacy policy written for Kenya: what you collect, why, how long you keep it, and who you share it with.
- Ask for consent before non-essential cookies such as advertising and analytics.
- Many businesses must register with the Office of the Data Protection Commissioner (ODPC).
- This is general information, not legal advice. For your situation, speak to a lawyer.
What counts as personal data on a website
- Names, phone numbers and email addresses from contact or quote forms.
- ID numbers, KRA PINs and dates of birth.
- Location and device data collected by analytics and advertising tools.
- Payment details, if you take payments.
What your website needs
| Item | What it should do |
|---|---|
| Privacy policy | Explain in plain language what you collect, why, how long you keep it, who sees it and how people can ask for it to be deleted. Mention the Data Protection Act, 2019. |
| Cookie notice | Let visitors accept or reject non-essential cookies, with a real “Reject” button. |
| Forms | Collect only what you need, and add a short note with a link to the privacy policy. |
| Security | https on every page, updated software, and limited admin access. |
| Data requests | A clear way for people to ask what you hold about them. |
A common mistake
Many Kenyan websites still show cookie notices that mention the EU’s e-Privacy Directive and nothing about Kenya. It looks careless to clients who know the law. Update the wording to refer to Kenya’s Data Protection Act.
Do you need to register with the ODPC?
Many businesses that handle personal data must register as data controllers or processors, depending on their size and sector. Insurance, health, education, finance and businesses handling large amounts of data are usually included. Check the ODPC’s current rules or ask a lawyer.
What happened to Mumbua
Mumbua’s website now has a privacy policy written for Kenya, a cookie notice with clear accept and reject buttons, and a shorter quote form that no longer asks for ID numbers until a client is ready to buy. She registered with the ODPC and trained her staff on what to do when someone asks for their data.
When the next corporate client asked the same question, she sent them a link to the privacy page. They signed a contract covering 80 staff.
Mumbua is a composite, based on situations we see often. The numbers are typical, not a promise.
Want your website set up properly?
We set up privacy pages, cookie consent and secure forms as part of every website and care plan. See web design and prices. Care plans start from KSh 3,500 a month.
Data protection and websites: FAQs
Does the Data Protection Act apply to small business websites?
Yes, if your website collects personal data such as names and phone numbers from people in Kenya.
Do I need a cookie banner in Kenya?
If you use non-essential cookies such as advertising or analytics, you should ask for consent, with a real option to say no.
Can I copy a privacy policy from another website?
No. It should describe what your business actually does with data, under Kenyan law.
What is the ODPC?
The Office of the Data Protection Commissioner, which oversees data protection in Kenya and registers data controllers and processors.
Is this legal advice?
No. It is general information. For your situation, speak to a lawyer.
