Data Protection Act and Marketing in Kenya: A Practical Guide for Businesses (2026)

If your marketing uses names, phone numbers, email addresses, photos or browsing data, Kenya’s Data Protection Act 2019 applies to you. In practice, it means you need a lawful basis, usually consent, to send direct marketing; you must tell people how their data will be used; every promotional message must include a free, simple way to opt out; and you must stop immediately when someone objects.

The Act is enforced by the Office of the Data Protection Commissioner (ODPC), which has issued fines and compensation orders against businesses over unsolicited messages and the use of people’s photos in ads. This guide explains the rules that matter most for marketers, in plain language, with a checklist you can use today.

Important: this is general information, not legal advice. For decisions about your specific situation, consult a qualified data protection lawyer.

The laws that apply to marketing

• Data Protection Act 2019: the main law. It sets out principles, data subject rights and the restriction on using personal data for commercial purposes without consent or legal authority.
• Data Protection (General) Regulations 2021: the detailed rules on consent, direct marketing, opt-outs and response times.
• Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021: who must register with the ODPC and the fees.
• Complaints Handling Procedure and Enforcement Regulations 2021: how complaints, enforcement notices and penalties work.

The core principles in marketing terms

• Lawful, fair and transparent: tell people what you collect, why and who you share it with.
• Purpose limitation: data collected to deliver an order should not be reused for promotions without consent.
• Data minimisation: collect only what you need. A newsletter signup rarely needs an ID number.
• Accuracy and storage limits: keep data correct and delete it when you no longer need it.
• Security: protect data from loss, leaks and unauthorised access.

Consent: what counts and what does not

Under the Act, consent must be express, unequivocal, informed, specific and freely given. The 2021 regulations add that consent must be specific to the purpose, that people must be told of their right to withdraw it, and that consent is not freely given when it is a non-negotiable part of the terms and conditions. The burden of proving consent sits with you.

Keep a record of when, how and for what each person consented, and make withdrawing consent as easy as giving it. Processing children’s data needs consent from a parent or guardian, which matters for schools, toy shops and family brands.

The direct marketing rules

The General Regulations define commercial use as using personal data to advance commercial or economic interests, and direct marketing includes sending an electronic message to someone about a sale or other advertising material. That covers SMS, WhatsApp broadcasts, emails, promotional calls and targeted ads built from personal data.

The key requirements:

1. A lawful basis: usually the person’s consent to receive direct marketing.
2. A free, simplified opt-out: it must take minimal time and effort and be free of charge, or at most a nominal cost.
3. Every message must point to the opt-out: for example “Reply STOP to opt out” or an unsubscribe link, including an option to opt out of all future marketing.
4. Stop after an opt-out: once someone opts out, you must not use their data for direct marketing.
5. Third-party sharing: if someone asks you to stop sharing their data with others for marketing, act within seven days.

The regulations make using personal data for commercial purposes without consent an offence, punishable by a fine of up to KES 20,000, up to six months’ imprisonment, or both. That is separate from the ODPC’s administrative fines.

People’s rights and the deadlines that apply

Because the right to object to direct marketing is absolute, you cannot argue your way out of it. Build your systems so that a STOP reply or unsubscribe click removes the person automatically and adds them to a suppression list.

Channel by channel

SMS and bulk SMS

Use only numbers that opted in, include the opt-out in every message and make sure your provider’s opt-out keyword works. Our bulk SMS marketing guide covers sender IDs and delivery.

WhatsApp

Broadcasts reach only contacts who saved your number, but you still need permission to send promotions. On the WhatsApp Business Platform, marketing templates should go only to opted-in contacts. See our WhatsApp marketing guide.

Email

Use double opt-in where possible and put an unsubscribe link in every campaign. Our email marketing guide for Kenya explains the tools and setup.

Ads, pixels and custom audiences

Uploading customer lists to Meta, Google or TikTok, or using pixels for retargeting, involves personal data. Use only lists collected with a lawful basis, explain it in your privacy policy and use the platforms’ hashing tools.

Photos, testimonials and creators

The ODPC has repeatedly acted on images used without consent. In 2022 it fined a smartphone brand KES 5 million after a complaint about a customer’s photo used in social media stories and the company’s failure to comply with an enforcement notice. In a 2025 complaint it ordered a business to pay KES 50,000 for using a person’s name and photo in social media ads without consent. Get written permission before posting customers, staff or event attendees in promotional content.

Registering with the ODPC

Registration is mandatory if your business has an annual turnover of KES 5 million or more, or 10 or more employees. Smaller businesses are exempt unless they are in a mandatory sector. The sectors that must register regardless of size include direct marketing, education, health care, hospitality (excluding tour guides), financial services, telecommunications, transport, property management, gambling, political canvassing and CCTV security.

Registration is valid for two years. If you suffer a data breach, you must notify the ODPC within 72 hours of becoming aware of it.

Fines and enforcement

The ODPC can issue enforcement notices and administrative fines of up to KES 5 million or 1 percent of annual turnover for the preceding financial year, whichever is lower. It can also order compensation for affected individuals. Recent cases relevant to marketers include:

• KES 5 million penalties in 2023 against two companies over unsolicited messages and failure to respond to complaints and enforcement notices.
• A 2025 order for a lender to pay a complainant KES 400,000 over unsolicited promotional texts and calls, made through an agent acting on its behalf.
• A 2025 order to pay KES 50,000 for using a person’s name and photo in social media ads without consent.

The lesson: you are responsible for agents, telemarketers and agencies acting for you.

Data protection compliance checklist for marketers

1. Check whether you must register with the ODPC, and renew every two years.
2. Publish a clear privacy policy and link it on every form, landing page and lead ad.
3. Use unticked, purpose-specific consent boxes for marketing.
4. Record when, how and for what each person consented.
5. Include a free, simple opt-out in every promotional message.
6. Process opt-outs automatically and keep a suppression list.
7. Never buy, rent or scrape contact lists.
8. Get written permission before using anyone’s photo, name or testimonial in ads.
9. Upload custom audiences only from lawfully collected data.
10. Limit staff access to customer data and secure your website with HTTPS and updates.
11. Put data protection clauses in contracts with agencies, SMS providers and call centres.
12. Prepare a breach plan so you can notify the ODPC within 72 hours.

Marketing that respects customers

Compliant marketing is also better marketing: people who asked to hear from you open, reply and buy more. Sedi Digital builds websites, forms, WhatsApp funnels and email programmes for Kenyan businesses with consent and opt-outs built in. See our web design service and social media management, or plan your project with Sedi Digital. For the bigger picture, read our guide to building a digital marketing strategy.