Personal data rarely stays within national borders. A Kenyan company may host customer records on a foreign cloud server, share staff files with its regional headquarters or use an overseas payments provider. This raises an important question: when personal data leaves Kenya, does the law travel with it?
On 8 September 2026, the Office of the Data Protection Commissioner (“ODPC”) published the Guidance Notes for Cross-border Data Transfers, 2026. The guidance reinforces the Data Protection Act, 2019 (Act) and the Data Protection (General) Regulations, 2021 (Regulations) and explains how the ODPC expects them to be applied. The guidance also provides practical direction on transferring personal data outside Kenya and reinforces the need for organisations to assess the legality, safeguards and risks associated with their international data flows.
Crossing borders is not a compliance free pass
Kenyan law does not prohibit cross-border transfers. Under regulation 40 of the Regulations, a transfer may rest on one of four bases: appropriate safeguards, an adequacy decision by the Data Commissioner, necessity (for example, to perform a contract, pursue a legal claim or serve a compelling legitimate interest) or the data subject’s consent.
Consent is a last resort, not a convenient default. It is available only where no other basis applies, and the individual must explicitly consent after being told of the risks.
A recipient’s reputation, privacy policy or group membership does not make a transfer lawful. Businesses must identify their legal basis and be ready to show the Data Commissioner, on request, that safeguards are in place before data moves. The Data Commissioner can also prohibit, suspend or attach conditions to a transfer, even where a business believes it has complied.
The guidance also expects businesses to record each one, including its date and time, the recipient, the justification and a description of the data and to notify the ODPC of their transfers on request.
A new toolkit for international data transfers
The guidance’s most practical feature is a set of standard contractual clauses for controller-to-controller and controller-to-processor transfers, together with a compliance checklist and an application form for binding corporate rules (“BCRs”).
The clauses cover security, data subject rights, onward transfers, government access requests, liability and the return or deletion of data. Their use is encouraged, not mandatory. Once adopted, however, they override weaker contract terms, cannot be amended to reduce protection, are governed by Kenyan law and can be enforced by data subjects. Before relying on them, the parties must also assess the laws of the destination country, including the risk of access by public authorities.
Businesses should therefore review their data processing agreements, outsourcing contracts and intra-group arrangements rather than rely on a generic confidentiality clause or a foreign provider’s standard terms. Multinational groups should note that BCRs require ODPC approval, so global rules approved elsewhere will not automatically suffice.
The hidden risk: where does your data go next?
The guidance confirms that storing personal data on cloud servers outside Kenya is a cross-border transfer. Helpfully, it also recognises that hosting data offshore to improve efficiency and service quality can be a legitimate interest supporting the transfer.
The bigger risk often lies further down the chain. A recipient may pass data on only with the transferring entity’s prior written authorisation and equivalent protection, and it remains fully liable for the onward recipient. Onward transfers for the recipient’s own purposes, such as analytics, profiling, product improvement or marketing, are strictly prohibited.
Many standard vendor terms reserve exactly these rights. Businesses, particularly financial institutions, insurers, healthcare providers and technology companies, should ask their providers where data is stored, who can access it, which sub-processors are involved and what the provider may do with it.
Sensitive data requires greater care
Section 49 of the Act requires explicit consent and confirmed safeguards before sensitive personal data leaves Kenya, and the guidance expects this to be reflected in the contract and transfer records. Kenya defines sensitive data broadly. Beyond health, biometric and genetic data, it covers property details, marital status, sex, sexual orientation and family details, including the names of a person’s children, parents and spouses.
This catches routine HR records. A group HR system hosted abroad may therefore involve sensitive data, and a general privacy notice will not meet these requirements.
Does everything have to stay in Kenya?
Not necessarily. Most personal data may be sent abroad if the conditions above are met. However, section 50 of the Act and regulation 26 of the Regulations require data processed for the strategic interests of the State to be processed through a server and data centre in Kenya, or to have at least one serving copy stored in a Kenyan data centre.
This covers processing for civil registration and identity systems, elections, public finance systems, protected computer systems, early childhood and basic education, and primary or secondary health care. Private schools, clinics and education or health technology providers should check this before choosing offshore hosting, as contractual safeguards do not override a localisation requirement.
Five questions to ask now
The guidance is a timely prompt for businesses to audit their international data flows. Five questions are a good place to start.
- Do you know every country your data goes to, including through cloud providers and their sub-processors?
- Which of the four legal bases supports each transfer, and can you prove it?
- Can your vendors use your data for their own purposes?
- Do you hold sensitive data, including HR data?
- Does any of your processing fall within a localisation category?
The answers will point to the next steps: updating contracts, carrying out data protection impact assessments for high-risk transfers, keeping transfer records and notifying the ODPC.
The bottom line
Cross-border data transfers are essential to modern commerce, but commercial convenience does not displace legal responsibility. Businesses that act now can reduce regulatory risk, strengthen oversight of their vendors and build trust with customers and partners.
Ultimately, the question is no longer simply where your data is stored, but whether you can account for where it goes, who controls it and how it remains protected. For businesses, that is a question worth answering before the next international data transfer takes place.
--
Read the full publication at ENS
About Afriwise
Afriwise is a legal intelligence platform for Africa,covering the laws and regulations of 40+ countries, built with 170+ in-countrylaw firms. For Kenya, Afriwise holds the consolidated statutory database,practical guidance developed with in-country law firms, regulatory alertswritten by regulatory lawyers, and sector universes from fintech andtelecommunications to gaming and liquor.
Explore Afriwise for Kenya | Request a demo
