Kenya Data Protection Act 2019 and automated decision-making

What it is

The Data Protection Act 2019 is Kenya’s general data protection law. It was assented to on 8 November 2019 and commenced on 25 November 2019, and it established the Office of the Data Protection Commissioner (ODPC) as the regulator. It gives effect to the right to privacy in Article 31 of the Constitution of Kenya.

Section 35 is the Act’s rule on automated individual decision-making, and it is the main binding rule in Kenyan law aimed at decisions made by algorithms, including AI systems, about people. The Data Protection (General) Regulations 2021 add detail in regulation 22. In July 2026 the ODPC published a draft Guidance Note on Artificial Intelligence that explains how the Act applies across the AI lifecycle.

Who it applies to

Section 4 applies the Act to the processing of personal data by a data controller or processor established or ordinarily resident in Kenya, and by one not established or resident in Kenya that processes personal data of data subjects located in Kenya.

Section 35 places duties on both data controllers and data processors. An organisation that uses a vendor’s AI system to score credit, screen applicants or decide insurance claims remains responsible for those decisions, and the vendor carries its own duties as a processor.

What it requires

Section 35(1) gives every data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them.

Section 35(2) disapplies the right where the decision is

• necessary for a contract, meaning for entering into or performing a contract between the data subject and the controller;
• authorised by law, where the law the controller is subject to lays down suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests; or
• based on the data subject’s consent.

Section 35(3) then sets a procedure for any decision with legal or significant effects that is based solely on automated processing. The controller or processor must notify the data subject in writing, as soon as reasonably practicable, that the decision was taken that way. After a reasonable period, the person can ask for the decision to be reconsidered, or for a new decision that is not based solely on automated processing. Under section 35(4) the controller or processor must consider the request, including any information the person provides, comply with it, and tell the person in writing what steps it took and what the outcome was.

Regulation 22 of the General Regulations adds safeguards for solely automated decisions. As the ODPC’s AI guidance note summarises it, controllers must prevent errors, use appropriate mathematical or statistical procedures for profiling or automated processing, put technical and organisational measures in place to correct inaccuracies and minimise errors, and process personal data in a way that eliminates discriminatory effects and bias.

Other parts of the Act apply alongside section 35. Section 31 requires a data protection impact assessment before processing likely to result in high risk to data subjects. Section 41 requires data protection by design and by default. Section 63 caps administrative fines at five million shillings or, for an undertaking, one per cent of annual turnover in the preceding financial year, whichever is lower.

For an AI system, that turns into four practical questions. Which systems make decisions about people with legal or significant effects, and is a person genuinely involved? Where a system decides on its own, which exception applies? Is there a process to notify the person in writing and to reconsider or retake the decision on request? And can the organisation show it has tested for errors and discriminatory effects, as regulation 22 expects?

Key dates

• 8 November 2019. The Data Protection Act is assented to.
• 25 November 2019. The Act commences.
• July 2026. The ODPC publishes a Guidance Note on Artificial Intelligence as a draft for consultation.

How it relates to other frameworks

Section 35 is modelled on GDPR Article 22, with the same three exceptions for contract, law and consent. It differs in procedure. Where the GDPR speaks of safeguards such as human intervention, Kenya’s Act sets a written notice and a request to reconsider or retake the decision, with a written reply. Regulation 22’s duties on errors, statistical procedures and discriminatory effects echo the GDPR’s recitals and turn them into obligations.

For banks and other institutions the Central Bank of Kenya licenses, the CBK’s draft Guidance Note on AI adds a sector right to human review of significant, adverse AI decisions. Organisations often structure the wider risk work on ISO/IEC 42001 or the NIST AI RMF.

A note on this page

This is Aicura’s reading of section 35 of Kenya’s Data Protection Act 2019. It is not legal advice and it is not the Act itself. Read the Act as published by Kenya Law, and take advice on how it applies to your organisation.