Legal insights
ICT, Data Privacy & AI Law
Kenyan ICT, data protection and AI law for organisations that process personal data. These guides cover the Data Protection Act 2019, registration and data protection impact assessments, lawful bases and consent, data subject access requests, breach notification, cross-border transfers, employee monitoring, fintech and digital lending, software and SaaS contracts, cyber incident response, and the governance questions a board should ask before buying an AI tool. Each article identifies the regulator guidance, the records to keep and the steps to take before a project or dispute escalates.
AI Recruitment and Employee Data
Before AI screens applicants or monitors staff in Kenya, check fairness, privacy, human review, vendor terms and safeguards.
Read the noteSending Personal Data Outside Kenya
A practical Kenya data-transfer checklist for cloud hosting, regional payroll, overseas support and vendors, based on the Data Protection Act and ODPC guidance.
Read the noteBuying an AI Tool: Board Legal Checks
A board checklist for buying AI tools in Kenya: personal data, security, vendor terms, human review, intellectual property, testing and exit controls.
Read the noteSoftware and SaaS Contracts in Kenya
A software subscription can be bought in a few clicks, but the contract behind it decides who owns the data, who is responsible when…
Read the noteChildren’s Data Protection in Kenya
Children now hand over personal data years before they understand what data is — to schools, learning apps, games and social platforms. Kenyan law…
Read the noteODPC Registration in Kenya: Do You Need It?
If your organisation keeps a customer list, runs a payroll or sends a newsletter, Kenyan data protection law already applies to you. One of…
Read the noteConsent and Marketing Messages in Kenya
Your marketing team wants to send ten thousand promotional SMS messages tonight. Before the send button is pressed, Kenyan law asks a simple question:…
Read the notePrivacy Policies for Kenyan Websites
Every Kenyan website that collects a name, an email or a phone number is processing personal data — and the Data Protection Act 2019…
Read the noteData Controller vs Data Processor in Kenya
Vendors, clients and regulators all ask whether your organisation is a data controller or a data processor. The answer shapes who must register, who…
Read the noteData Breach Notification in Kenya
An employee's laptop is stolen from a parked car. It holds a spreadsheet of client names, phone numbers and identity document copies. A misdirected…
Read the noteNeed advice on a Kenyan matter?
Speak to a lawyer or advocate.
Tell us what is at stake and any deadline. An advocate will confirm whether the firm can act, explain the next step and call you back within one business day.