Corporate training Guides Data protection training by country
Kenya's Data Protection Act, 2019: a staff training guide for employers
Kenya's Data Protection Act, 2019 holds every data controller and data processor responsible for protecting personal data. The Office of the Data Protection Commissioner (ODPC) enforces it, and has already issued penalty notices against organisations.
What the Act asks of employers
The Act sets out principles for processing personal data lawfully, fairly and transparently, for specified purposes, and keeping it secure. Organisations must build data protection into their systems and processes by design and by default, and many data controllers and processors must register with the ODPC.
When a breach creates a real risk of harm, the data controller must notify the Data Commissioner within 72 hours of becoming aware of it, and tell the people affected as soon as practicable. That timescale is only achievable if staff recognise a breach and report it straight away.
Penalties and enforcement
The Data Commissioner can issue administrative fines of up to KES 5 million or 1 per cent of the previous year's annual turnover, whichever is lower, and compensation can be ordered for people harmed. The ODPC has issued penalty notices in sectors including digital lending, education and hospitality, so enforcement is real.
Why staff training matters
Many data protection failures are everyday mistakes: personal data sent to the wrong recipient, customer lists shared on personal WhatsApp groups, documents left on shared drives, or a login handed to a fraudster. Training is how you turn your policies into habits.
It also gives you evidence. If the ODPC investigates, records of who was trained, when and on what show the organisational measures you had in place.
What the training should cover
- The data protection principles in plain language, with examples from your sector
- Lawful bases, consent and the rights of data subjects, including access and erasure requests
- Handling, sharing and retaining personal data safely, including on mobile phones and messaging apps
- Spotting phishing, SIM-swap and impersonation scams that lead to breaches
- How to report a suspected breach internally, fast enough to meet the 72-hour rule
- Rules for using AI tools without exposing personal data
Related law
The Computer Misuse and Cybercrimes Act, 2018 criminalises unauthorised access, cyber fraud and related offences, and sector regulators such as the Central Bank of Kenya set their own cybersecurity expectations. Your training should reflect the rules that apply to your sector.
Related training programmes
- CyberSecure Workforce: Programme details
- AI Workflow Productivity & Process Transformation: Programme details
Frequently asked questions
Does the Data Protection Act require staff training?
The Act requires appropriate technical and organisational measures to protect personal data and data protection by design. Staff training is one of the main organisational measures, and records of it help show compliance.
How fast must a breach be reported in Kenya?
Where there is a real risk of harm, the Data Commissioner must be notified within 72 hours of the data controller becoming aware of the breach.
Can you train teams across Nairobi, Mombasa and Kisumu together?
Yes. Paleon Training delivers live online sessions with a facilitator, so teams in different locations can train together.
Is this guide legal advice?
No. It is general guidance, not legal advice. See the Office of the Data Protection Commissioner's guidance or take legal advice on your organisation's obligations.
Published 09/11/2026 by Paleon Training Limited. General guidance, not legal advice.
Talk to us about training your teams
Paleon Training runs corporate AI and cybersecurity training for organisations in Kenya. Start with the free readiness check, or book a consultation and we will recommend a format for your organisation.