Data Protection Act for Kenyan Freelancers and Small Websites: What You Must Do in 2026

Plenty of Kenyan freelancers assume the Data Protection Act is for banks, telcos and big companies. That's a risky assumption. The exemption is narrow, and some of the fines reported so far came from ordinary behaviour: posting a photo, or messaging a former client.

This post is general information, not legal advice. The figures below come from law-firm and compliance blogs, not from the Act itself, so please check fees, thresholds and deadlines on the Office of the Data Protection Commissioner (ODPC) website, odpc.go.ke, before you act.

"I'm too small" is the most common mistake

The Data Protection Act, 2019 covers anyone handling the personal data of people in Kenya. Under section 18, you generally must register with the ODPC before acting as a data controller or processor. Small operators can be exempt, but only if both of these are true:

• Your annual turnover is below KES 5,000,000.
• You have fewer than ten employees.

Several law firms describe the exemption this way. Meeting one condition isn't enough.

Even then, the exemption can fall away depending on your sector. One law firm's list of sectors that must register regardless of size includes direct marketing businesses, educational institutions, property management or sales, health, financial services and hospitality. A freelancer doing email marketing, tutoring or property-related work could be caught by this.

A quick self-test:

1. Is my turnover under KES 5 million?
2. Do I have fewer than ten employees?
3. Does my work fall in a sector that must register anyway?

If you answer "no" to either of the first two, or "yes" to the third, assume you need to register. If you think you're exempt, write down why and keep the note. That record helps if anyone ever asks.

Freelancers wear two hats

The Act uses two terms worth knowing:

• A controller decides why and how personal data is collected.
• A processor handles personal data on someone else's behalf.

As a freelancer you're a controller of your own clients' details: names, phone numbers, invoices, emails. You may also be a processor when you handle your client's customers' data. That could be a web developer with access to a shop's customer database, a virtual assistant managing a client's inbox, or a marketer running a client's mailing list.

One source suggests that someone acting in both roles may need to register for each, with a separate fee. That is worth confirming with the ODPC when you apply.

Registering with the ODPC: cost, timeline, renewal

Registration is done online through the ODPC portal. According to the sources, the fees for micro and small entities are:

• KES 4,000 to register
• KES 2,000 to renew

Certificates are reported to be valid for 24 months, and to be issued within 14 days of a complete application. Renewal should be applied for at least 30 days before expiry.

The fee is small. The real work is the paperwork, so put your expiry date in your calendar with a reminder. If you've already registered, check when your certificate runs out. The ODPC has been reported to chase lapsed registrations, and registration is reportedly one of the first things reviewed when a complaint comes in.

What your website needs, beyond the basic checklist

In Your Customers Are Checking You Out: What They Find (or Don't) in 2026, we covered what buyers see when they look you up. Data protection adds a few items to that list.

• A privacy notice. It should explain what you collect, why, who else sees it, and how people can exercise their rights. Link it from your footer and next to any form, such as contact, newsletter or checkout.
• Real consent. The Act describes consent as express, unequivocal, free, specific and informed. In practice, that means no pre-ticked boxes and no assuming someone agrees because they kept browsing.
• Cookies and analytics. Cookie-tool vendors say tracking cookies such as Google Analytics' _ga and Facebook's _fbp count as personal data processing. The Act has no separate cookie section, so the general consent rules apply. If you run analytics or ad pixels, ask for consent first and make it easy to withdraw.
• A way to handle requests. People have rights to access, correct, object to and delete their data. You don't need a complicated system. A clear email address and a habit of answering promptly is a start.
• Know your tools. Hosting, email and analytics providers are often based outside Kenya. Sending data abroad isn't automatically banned, but the Act requires safeguards or consent for transfers.

Check what your contact form collects, too. If you don't need a phone number or ID number, don't ask for it.

Everyday slips that have led to fines

The cases below were reported by law firms, and they involve ordinary behaviour:

• Oppo Kenya was reported fined KES 5,000,000 for posting a person's photo on Instagram stories without their consent.
• Regus Kenya was fined for continuing to send marketing to a former client and for ignoring the ODPC's complaint notification. The High Court reportedly upheld the ODPC's decision but reduced the fine to KES 2.5 million, as a first-time offence.
• In one ruling, verbal consent was held insufficient because it wasn't documented at the time.

Not every business here was small, but the behaviour is something any freelancer could do. Some habits that protect you:

• Get written permission (even a WhatsApp message or email) before using a client's photo, name or testimonial.
• Keep a record of when and how each person joined your newsletter or broadcast list.
• Stop contacting people once they ask, including former clients.
• Don't add people to a list just because you have their number.

If something goes wrong

Say a laptop is stolen, an email account is hacked, or a spreadsheet of client details is shared with the wrong person. One source says a controller must notify the ODPC within 72 hours of discovering a breach, and a processor must notify the controller within 48 hours. Confirm these timelines on the ODPC site, and know them before an incident happens.

Also, never ignore a letter or notification from the ODPC. In the Regus case, ignoring the complaint notice was part of the problem, and reports of the ODPC's recent activity suggest that ignoring the regulator escalates matters.

Your 2026 to-do list, and what may change

Here's a short list to work through:

1. Run the three-question self-test and write down the result.
2. Register with the ODPC if you need to, or document why you're exempt.
3. Put your certificate's expiry date in your calendar.
4. Add a privacy notice to your website and link it from your forms.
5. Fix your consent: no pre-ticked boxes, and a cookie banner that works.
6. Get written permission for photos and testimonials.
7. Keep a record of how people joined your mailing or WhatsApp list.
8. Decide who you'd contact, and how, if you had a data breach.

As for the risk of getting it wrong, the sources report administrative fines of up to KES 5 million or 1% of annual turnover, whichever is lower. Sources disagree on the criminal side, so check the Act itself.

A note on what may change: an Amendment Bill 2025 has been reported. Proposals include switching the fine rule to "whichever is higher", widening the categories of sensitive data, and adding rights such as data portability. I couldn't confirm whether it has passed, so treat it as proposed and check the ODPC website for the latest.

If you're building a freelance business, as covered in Freelancing as a Researcher: From Knowledge to Income and Building Daily Routines for Financial Freedom, compliance is part of the routine. Set aside an hour this month to work through the list above, and you'll be ahead of most small operators.