Kenya Data Protection Act and Marketing Messages: A Compliance Guide

Phone numbers, names, email addresses and chat histories are personal data. The moment a Kenyan business uses them to send WhatsApp messages, SMS or emails, the Data Protection Act, 2019 applies. Complaints about unsolicited messages are among the most common the regulator handles, and several have ended in compensation orders against businesses.

This guide turns the Act into practical steps for a business that messages customers. It covers registration with the Office of the Data Protection Commissioner (ODPC), consent, purpose limitation, people's rights and opt-outs. It is general information, not legal advice: for advice on your own situation, speak to a lawyer or contact the ODPC.

Before you start

Gather the following:

• A list of every place you collect phone numbers or emails: shop till, website forms, WhatsApp chats, Instagram, admission forms, loan applications, events.
• Your current contact lists and where they are stored: phones, spreadsheets, your POS, your messaging platform.
• The names of any service providers that handle the data for you, such as your SMS provider, email platform or CRM.
• Your business size: annual turnover and number of employees, which affect whether you must register.

Step 1: Check whether you must register with the ODPC

Under section 18 of the Act, data controllers (who decide why and how data is used) and data processors (who handle data on a controller's behalf) may need to register with the Data Commissioner. The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 set the detail.

In broad terms, small businesses below the turnover and staff thresholds in those regulations are exempt, unless they work in a sector listed as requiring registration. The listed sectors include, among others, education, health care, financial services, hospitality, property management, transport and businesses that are wholly or mainly in direct marketing. So a small private school, clinic or SACCO usually needs to register even if it is small. Registration is done online, carries a fee that depends on business size, and must be renewed. Check the current thresholds, sector list and fees on the ODPC website before you decide.

Step 2: Write down what data you use and why

The Act's principles, in section 25, include purpose limitation (use data only for the purpose it was collected for) and data minimisation (collect only what you need). A short record for each list keeps you honest:

The test is simple: if a number was collected for delivery updates, it cannot quietly join your promotions list. Ask for consent separately.

Step 3: Get and record consent for marketing

Section 37 says you may not use personal data for commercial purposes, such as marketing, unless the person has given express consent or you are authorised by law and told them when you collected it. Section 32 puts the burden of proving consent on you and lets people withdraw it at any time.

In practice:

• Ask a clear question at each collection point: "Can we send you offers by SMS or WhatsApp?" Do not pre-tick the box.
• Record the yes with the date and source, for example "Till, Sarit branch, 12 Oct 2026" or "Website form".
• Never buy, borrow or swap contact lists. People on them did not consent to hear from you.

In chat.or.ke, tag contacts who opted in and send promotions only to that tag. Our guide to building a WhatsApp opt-in list has wording that works.

Step 4: Tell people how you use their data

Section 29 requires you to tell people, when you collect their data, what you are collecting, why, who it may be shared with and how they can exercise their rights. A short privacy notice on your website, linked from forms and your WhatsApp profile, covers most of this. A line on paper forms helps too: "We will use your number to send fee and school notices by SMS. See our privacy notice for details."

Step 5: Give an opt-out in every promotion and honour it fast

Section 36 gives people the right to object to processing, including for direct marketing. The Data Protection (General) Regulations, 2021 add that the opt-out must be free, clear and simple; replying with a word such as STOP is accepted.

Because nobody can reply to an SMS sender ID, give a route such as "Opt out: WhatsApp STOP to 07XX XXX XXX". In chat.or.ke, contacts who send STOP to your WhatsApp or SMS line are marked as opted out and skipped in every future SMS and WhatsApp campaign, and every email campaign includes a one-click unsubscribe link. Our article on opt-in and opt-out rules in Kenya goes deeper, and the bulk SMS rules page lists the ODPC decisions on unsolicited messages.

Step 6: Handle access, correction and deletion requests

Section 26 gives people the right to be told how their data is used, to access it, to object, and to have false or misleading data corrected or deleted. Decide now who in your team handles these requests and how.

A workable process for a small business:

1. Accept requests on any channel you use, including WhatsApp, and log them.
2. Confirm the person's identity before sharing anything.
3. Find their record: a contact profile in a CRM shows chats, notes and tags in one place, which makes this quick.
4. Reply promptly with what you hold, or confirm the correction or deletion.
5. If someone complains about a message, stop messaging them, explain where you got their number and fix the source.

Step 7: Keep contact lists secure and choose processors carefully

The Act requires appropriate security measures and data protection by design (section 41). For messaging, that usually means:

• Keep contacts in one secure system, not on staff phones and loose spreadsheets.
• Limit who can export lists, and remove access when staff leave.
• Keep sensitive personal data, such as health information, out of SMS and broadcasts.
• Use processors that act only on your instructions, under a written agreement.
• Know what to do if data leaks: section 43 requires notifying the Data Commissioner within 72 hours of becoming aware of a breach that risks people's rights.

With chat.or.ke, you remain the data controller for your customers' data and chat.or.ke processes it to provide the service. Workspaces are isolated, staff access is controlled by role, credentials are encrypted, and you can export your contacts at any time. The FAQ covers data ownership and deletion.

What are the penalties for getting it wrong?

Under section 63, the Data Commissioner can impose a penalty of up to KES 5 million or 1% of the previous year's turnover, whichever is lower. People who suffer damage can also be awarded compensation under section 65. Complaints about unsolicited marketing have so far mostly ended in compensation orders, each started by a single complainant.