Kenya Data Protection Act 2019: what hosting customers must know
A plain-English guide for businesses hosting a website or app that serves people in Kenya.
Legal position as of 30.09.2026. General information, not legal advice.
Short answer
- 1If you run a website or app that collects personal data from people in Kenya, you are normally the data controller, and your hosting provider acts as your data processor.
- 2Section 18 of the Act says no one may act as a controller or processor unless registered with the Data Commissioner, subject to the thresholds the Commissioner prescribes.
- 3Section 42 requires a written contract in which the processor acts only on your instructions, and you must choose a processor that gives sufficient guarantees on security.
- 4If a breach puts data subjects at real risk of harm, you must notify the Data Commissioner within seventy-two hours of becoming aware of it (section 43).
- 5Choosing a host outside Kenya is not banned by the Act, but it is a cross-border transfer with its own conditions (sections 48 and 49).
Who is the controller and who is the processor?
The controller decides why and how personal data is processed. A hosting provider that stores and serves that data on your behalf is a processor. Under section 42(3), a processor that handles personal data other than as instructed is deemed a controller for that processing, so the contract should be tight about purpose.
Registration: read the Regulations, not only the Act
Section 18 leaves the thresholds to the Data Commissioner. The Registration Regulations 2021 (Legal Notice 265), regulation 13, exempt a controller or processor with annual turnover or revenue below five million shillings and fewer than ten employees.
The exemption does not apply if the business processes personal data for a purpose listed in the Third Schedule. The list includes health administration and patient care, financial services, operating an educational institution, hospitality, property management, direct marketing, telecommunications, transport services and businesses that process genetic data. Exempt entities must still comply with Parts IV and VI of the Act. Confirm your position with the Office of the Data Protection Commissioner (ODPC).
The processor contract: sections 41, 42 and the General Regulations
Section 41 requires appropriate technical and organisational measures, including, where suitable, pseudonymisation, encryption and the ability to restore access to data after an incident. Section 42(2) adds the written contract and the duty to pick a processor with sufficient guarantees.
Regulation 24 of the Data Protection (General) Regulations 2021 lists what the contract must contain: the subject matter, duration, nature and purpose of processing, the type of data and categories of data subjects, your instructions, confidentiality commitments, security measures, deletion or return of data when the agreement ends, and audit and inspection rights.
Regulation 25 says a processor may not engage a sub-processor without your prior authorisation and remains liable to you for that third party.
Breach notification in practice
Section 43 has two clocks, and your hosting agreement should say how the provider reports incidents. The controller notifies the Data Commissioner within seventy-two hours of becoming aware of a qualifying breach; if it is late, the notice must state the reasons. The processor must notify the controller without delay and, where reasonably practicable, within forty-eight hours.
Data location: what the Act actually says
Sections 48 and 49 set conditions for transferring personal data out of Kenya, including proof of appropriate safeguards and, for sensitive personal data, consent plus confirmation of safeguards. Section 50 allows the Cabinet Secretary to require that certain processing happens only on a server or data centre in Kenya.
Regulation 26 of the General Regulations lists purposes of strategic interest that must be processed in Kenya or keep one serving copy there, such as civil registration, elections, public finance systems, basic education and primary or secondary health care. If your project falls in that list, a European host alone is not enough.
Three Kenyan scenarios
An online shop in Nairobi
It collects names, phone numbers and delivery addresses. The owner is the controller, checks regulation 13 for registration, signs a processor contract with the host and keeps an incident contact ready.
A private clinic in Kisumu
Health administration and patient care appear in the Third Schedule, and primary health care appears in regulation 26. The clinic should take legal advice before choosing any host outside Kenya.
A Mombasa SaaS with users in several countries
It uses a VPS for its app and database. It sets backup and deletion rules in the contract and documents the cross-border transfer.
Common mistakes
- Assuming the hosting provider is responsible for your registration. Registration is your duty as controller or processor, where it applies.
- Using a host with no written processor contract, or one that does not mention deletion or return of data at the end.
- Treating the five-million-shilling exemption as automatic when the Third Schedule applies to your activity.
How 4hosting helps
Our data centre is in the European Union, in Frankfurt, not in Kenya. We offer a data processing agreement (Article 28 GDPR) and work in alignment with ISO 27001; we do not hold an ISO 27001, NIS2 or other certification, and we do not certify your compliance with the Kenyan Act.
VPS, dedicated and GPU plans, and cPanel plans from Advanced upward, include monthly DevOps and CyberSecurity hours. Migration is free, and invoices are in EUR.
Talk to us about your case →Frequently asked questions
Is my hosting provider the data controller?
Usually not. For the personal data of your own customers you decide the purposes, so you are the controller and the host is your processor. A processor that uses data outside your instructions can be deemed a controller for that use (section 42(3)).
Do I have to register with the ODPC?
It depends on your size and activity. Regulation 13 exempts small entities below five million shillings and ten employees, except for Third Schedule purposes. Confirm with the ODPC or a Kenyan advocate.
Does 4hosting certify that I comply with the Act?
No. 4hosting is not a compliance certifier and holds no Kenyan data protection certification. It provides infrastructure and a data processing agreement; compliance is your responsibility with your legal adviser.