How Kenya’s New Data Guidance Addresses Global Transfers
A positive adequacy decision by the European Commission would allow personal data to flow from the EU to Kenya without the need for additional transfer mechanisms under the GDPR. The ODPC notes set out the conditions under which personal data may currently leave Kenya.
Kenya’s Office of the Data Protection Commissioner (ODPC) published its Guidance Notes for Cross-border Data Transfers in September 2026. The notes provide operational guidance on Part VI of the Data Protection Act (DPA) of 2019 and Regulation 40 of the Data Protection (General) Regulations of 2021. They apply to all entities that handle personal data within Kenya and transfer or intend to transfer such data outside Kenya.
The timing of the release coincides with Kenya’s ongoing adequacy assessment with the European Union. In June 2026, during discussions between Kenyan President William Ruto and European Commission Executive Vice-President Henna Virkkunen, the EU noted positive progress in the EU-Kenya data adequacy process so far and its intention to conclude the evaluation as soon as possible.
How Data is Allowed to Leave
The foundational legal architecture is set out in the DPA and the General Regulations. Controllers and processors must establish a valid legal ground before transferring personal data outside Kenya. Regulation 40 identifies the available bases as appropriate data protection safeguards, an adequacy decision made by the Data Commissioner, transfer as a necessity, or the consent of the data subject.
The September 2026 guidance supplies operational detail on these requirements. It includes standardised contractual clauses for controller-to-controller and controller-to-processor transfers, formal application procedures and forms for Binding Corporate Rules (BCRs), and documentation requirements. Organisations relying on appropriate safeguards are encouraged to incorporate the clauses into their legal instruments and may adapt them where necessary to reflect the specific circumstances of a transfer, provided the level of protection is not reduced.
Immaculate Kassait, Data Commissioner at the Office of the Data Protection Commissioner, stated in the guidance:
“It provides practical guidance on the conditions for lawful cross-border transfers, the safeguards that must be in place, and the mechanisms available to ensure adequate protection of personal data in the recipient country or organisation.”
Balancing Sovereign Data And Global Flows
The guidance incorporates concepts used in international frameworks, including adequacy decisions, BCRs, assessments of the recipient’s legal environment, and supplementary safeguards. The European Union’s 2021 Standard Contractual Clauses contain four modules covering controller-to-controller, controller-to-processor, processor-to-processor, and processor-to-controller relationships. Kenya’s guidance supplies standardised clauses for controller-to-controller and controller-to-processor transfers only.
Under Regulation 41(2), transfers made in reliance on appropriate safeguards must be documented. The documentation must include the date and time of the transfer, the name of the recipient, the justification for the transfer, and a description of the personal data transferred, and must be provided to the Data Commissioner on request. The guidance further states that data controllers and processors that transfer personal data outside Kenya are required to notify the ODPC of the transfer so that the Office is aware of cross-border data flows and can monitor compliance.
Decoding Kenya’s New Offshore Transfer Framework
Section 50 of the Data Protection Act provides that personal data processed for the strategic interests of the state must be domiciled in Kenya. A data controller or data processor who processes personal data for such purposes must either process the data through a server and data centre located in Kenya or store at least one serving copy of the concerned personal data in a data centre located in Kenya.
The guidance restates the categories set out in Regulation 26 of the General Regulations. These are: administering of the civil registration and legal identity management systems; facilitating the conduct of elections for the representation of the people under the Constitution; overseeing any system for administering public finances by any state organ; running any system designated as a protected computer system in terms of section 20 of the Computer Misuse and Cybercrime Act; offering any form of early childhood education and basic education under the Basic Education Act; and provision of primary or secondary health care for a data subject in the country. The guidance states that localisation requirements must be complied with before any transfer where they apply.
The Collaboration on International ICT Policy in East and Southern Africa (CIPESA), in its submission on the ODPC’s draft guidance notes on artificial intelligence and emerging technologies, stated that requirements for adequacy assessments prior to cross-border transfers of AI-processed personal data could lead to broad data localisation and impede cross-border AI inference and cloud computing if not aligned with regional frameworks. The ODPC guidance itself confines the localisation obligation to the specific purposes listed in Regulation 26.
The Broader Implications for Global Compliance
The guidance supplies organisations with standardised clauses, BCR application materials, and documentation requirements that implement the existing provisions of the Act and Regulations. A positive adequacy decision by the European Commission would allow personal data to flow from the EU to Kenya without the need for additional transfer mechanisms under the GDPR. The ODPC notes set out the conditions under which personal data may currently leave Kenya.
