Hosting Kenyan personal data in Europe: cross-border transfer rules and ODPC guidance

A practical guide for Kenyan businesses, developers and agencies deciding where to host customer data. Based on the ODPC guidance note on cross-border data transfer. Status as of 30.09.2026. This is general information, not legal advice.

Short answer

1According to the ODPC guidance note, processing personal data on cloud servers outside Kenya is a cross-border data transfer.
2A transfer needs one of four bases: appropriate safeguards, an adequacy decision by the Data Commissioner, necessity, or the consent of the data subject (Part VI of the Act and regulation 40, as cited in the note).
3The note gives hosting data on foreign cloud servers as an example of a legitimate interest of the controller, provided it does not override the data subject's rights.
4Personal data processed for the strategic interests of the State must be processed in Kenya or have at least one serving copy in a Kenyan data centre (section 50, regulation 26).
5You stay responsible as controller. A hosting provider does not certify legal compliance for you.

What the ODPC note says about transfers

The Office of the Data Protection Commissioner (ODPC) published a guidance note on cross-border data transfer in 2026. It is guidance, not a statute: it explains how the Office reads the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. The note lists the Constitution, the Act, the Regulations, the Computer Misuse and Cybercrimes (Amendment) Act, 2024 and the Kenya Cloud Policy 2024 as the framework.

Regulation 40, as cited in the note, names the four bases for a transfer. Under appropriate safeguards you either rely on a legal instrument that binds the recipient to protection essentially equivalent to Kenyan law, or you assess the circumstances and conclude that adequate safeguards exist.

Cloud and VPS hosting outside Kenya

The note has a section on cloud storage. It states that processing personal data in cloud environments with servers outside Kenya is a cross-border transfer and that controllers share responsibility with the provider. Before you start, it expects a lawful basis, a provider with adequate technical and organisational safeguards, a data processing agreement and regular review of the provider's terms and sub-processors.

It recommends concrete security measures: keep the provider's audit logs, configure access correctly, encrypt data in transit and at rest, use multi-factor authentication where you can, consider anonymisation and keep a backup you can restore. On a VPS or dedicated server you control most of these settings yourself, which the note says gives IaaS users more control over their systems and data.

On localisation, section 50 and regulation 26, as cited, require processing through a server and data centre in Kenya, or at least one serving copy there, for activities such as civil registration, elections, public finances, designated protected computer systems, early childhood and basic education, and primary or secondary health care. If your project is on that list, plan the Kenyan copy first.

Real-world examples

Nairobi online shop on a VPS in Frankfurt

The shop stores customer names, phone numbers and delivery addresses on a server in Germany. It treats this as a transfer, records the basis it relies on, signs a written processing agreement with the host and keeps transfer documentation ready for the Commissioner.

Mombasa SaaS with a PostgreSQL database in the EU

A software company keeps its customers' records in a managed-by-itself database on a rented server in Bucharest. It encrypts data in transit and at rest, enables multi-factor authentication on admin accounts and keeps provider audit logs, as the note recommends for cloud use.

Common mistakes

Treating a foreign VPS as "just hosting" and not as a transfer. The ODPC note says cloud servers outside Kenya are a cross-border transfer.
Having no written agreement with the host. The note asks for a processing agreement that names the recipient countries and covers security, breach reporting, audits and deletion or return of data.
Forgetting transfer records. Regulation 41(2), as cited, asks you to document the date and time, the recipient's name, the justification and a description of the data, and to give it to the Commissioner on request.
Moving sensitive personal data without explicit consent and confirmed safeguards (section 49(1), as cited in the note).

How 4hosting helps

Our datacenter is in the EU, in Frankfurt, not in Kenya. We say this plainly so that you can name the destination countries accurately in your agreement and transfer records. We offer a data processing agreement (DPA) under GDPR Article 28 and standard contractual clauses for transfers, which gives you a written processor contract to start from. Whether it meets your Kenyan obligations is your decision, with your adviser.

Every plan includes monthly DevOps, CyberSecurity and Programming hours (from cPanel Advanced upwards; VPS plans include 1 to 8 hours). You can use them for server hardening, backups, WAF rules and access control. 4hosting is not a compliance certifier and does not sign legal compliance for you. Migration is free. See the plans for what is included.

Frequently asked questions

Is it legal to host Kenyan personal data in the EU?

The ODPC guidance note does not ban foreign hosting. It sets conditions: a lawful basis for the transfer, a written processing agreement, security measures and documentation. Localisation rules apply only to strategic-interest processing. Check your case with a Kenyan lawyer or the ODPC.

Where are 4hosting servers?

In the EU: Frankfurt, with points of presence in Frankfurt, London and New York. There are no 4hosting datacenters in Kenya.

Does 4hosting make me compliant with the Data Protection Act?

No. 4hosting does not certify legal compliance and holds no ISO, SOC 2 or similar certification; we describe our security practice as aligned with ISO 27001. We offer a data processing agreement (DPA) under GDPR Article 28 and standard contractual clauses for transfers, which can support your own paperwork.