Kenya's Office of the Data Protection Commissioner (ODPC) has issued guidance on cross-border data transfers, setting out obligations for organisations handling personal data.
The guidance applies to all entities that handle personal data within Kenya and transfer or intend to transfer it outside the country.
It outlines the legal, regulatory and operational obligations that data handlers must observe to protect personal data when it is transferred to foreign jurisdictions or when data is received from abroad.
The guidance provides a framework for cross-border data transfers, safeguarding the privacy and rights of data subjects, promoting transparency and accountability, and mitigating risks associated with cyber threats, unauthorised access and data misuse.
Additionally, it aims to align Kenya's data protection practices with international standards, ensuring that organisations can engage in global operations while remaining compliant with relevant legislation.
“As Kenya continues to integrate into the global digital economy, ensuring that cross-border transfers of personal data uphold data privacy and protection standards remains a core interest and mandate of the Office of the Data Protection Commissioner,” Immaculate Kassait, data commissioner, said.
She said the guidance note had been developed to assist data controllers and data processors in understanding their obligations when transferring personal data.
“It provides practical guidance on the conditions for lawful cross-border transfers, the safeguards that must be in place, and the mechanisms available to ensure adequate protection of personal data in the recipient country or organisation.”
Several legislative frameworks govern the cross-border transfer of personal data in Kenya.
These include the Constitution of Kenya (2010), the Data Protection Act (2019) and the Kenya Cloud Policy (2025).
Share
