Data Protection Officer in Kenya: When You Need One and What They Do

When you should appoint a DPO

Under the Act, the expectation of a DPO attaches to what you do with data rather than to your size. Public bodies are covered. So are organisations whose core activities require regular and systematic monitoring of individuals, such as telecoms, fintech, lenders and platforms that track customer behaviour, and those whose core activities involve sensitive personal data, which includes health, biometric, financial and children's data among others.

Even where it is not strictly expected, many organisations appoint one because somebody has to own registration with the ODPC, data subject requests, breach notification and impact assessments. A group of companies may share a single DPO, provided that person is accessible to each of them.

What a DPO actually does

The Act describes the DPO's role as advising and monitoring. In practice, the recurring work looks like this.

• Advising management and staff on their obligations under the Act.
• Monitoring compliance: policies, records of processing, retention and vendor contracts.
• Advising on and reviewing data protection impact assessments for new systems and projects.
• Handling data subject requests for access, correction and deletion within the required timelines.
• Coordinating breach response and notification to the Data Commissioner.
• Training staff and acting as the point of contact with the Office of the Data Protection Commissioner.

Qualifications and independence

The Act asks for a DPO with relevant academic or professional qualifications, which may include knowledge and technical skills in data protection. In practice, look for demonstrable knowledge of the Kenyan Act and regulations, a recognised privacy certification, and enough technical understanding to question how systems actually store and share data. Legal knowledge without technical grounding tends to produce excellent policies that describe systems which do not exist.

Independence matters as much as expertise. A DPO who also runs IT or marketing is marking their own homework. Whoever holds the role must be able to raise concerns directly with senior management without being penalised for doing so.

In-house or outsourced

Large organisations and those processing sensitive data at scale usually benefit from a dedicated in-house DPO, often supported by external specialists. For most small and mid-sized organisations, an outsourced DPO service offers specialist expertise, built-in independence and continuity at a fraction of a full salary, with the provider learning the business over time.

The weakest option is adding the title to an existing staff member's job description without time, training or authority. It creates the appearance of compliance and the reality of none.

Getting started

Whichever route you choose, the first ninety days should produce a record of processing activities, confirmation of ODPC registration status, a breach response procedure, a process for data subject requests, and a prioritised list of gaps. That list, not the appointment letter, is the evidence the role is working.

Key takeaways

• The DPA expects a DPO for public bodies, systematic monitoring and sensitive data processing, whatever your size.
• The DPO advises, monitors compliance, handles data subject requests, breaches and impact assessments, and liaises with the ODPC.
• Look for Kenyan DPA knowledge, a privacy certification and enough technical grounding to test reality.
• Independence matters: avoid giving the role to the person running IT or marketing.
• Outsourced DPO services suit most SMEs; adding the title to an existing job rarely works.

Frequently asked questions