The legal framework
Article 31 of the 2010 Constitution protects privacy, including of communications and of information relating to family or private affairs. The Data Protection Act 2019 created the Office of the Data Protection Commissioner, which has become one of the more active regulators on the continent, issuing enforcement and penalty notices.
Key points
| Constitution | Article 31, expressly covering communications and personal information |
|---|---|
| Statute | Data Protection Act 2019, with registration of controllers and processors |
| Regulator | Office of the Data Protection Commissioner, free complaints |
| Registration | Mandatory for many controllers and processors above thresholds |
| Penalties | Penalty notices capped by reference to turnover |
| Court | High Court petition under Article 22 for constitutional violations, without fees |
| Article 22 petitions | No filing fee, and open standing |
| Damages | Courts have awarded compensation for unlawful disclosure of personal data |
| Digital lending | A major enforcement focus for the Commissioner |
In practice
- Send a written access request first: it forces the other side to disclose what it holds and creates a paper trail.
- Screenshot everything, with the date and the URL visible, before asking for removal.
- Complain to the regulator — it is free — and keep the reference number.
- Court action is the last step, and the limitation periods are short: take advice early.
- File an Article 22 petition where a public body is involved: there is no filing fee.
Where to go
- Office of the Data Protection Commissioner.
- High Court constitutional petition under Article 22.
- Kenya National Commission on Human Rights.
Worth knowing
Article 22 petitions carry no filing fee and can be brought by anyone, including on behalf of someone unable to act: it is an unusually open door. Kenya combines an active regulator with free constitutional petitions. Using both at once is common and effective.
Official sources and links
- eCitizen — official government services portal