1
Uliza kwanza.
Right to be informed
Anyone collecting your data must tell you what they are collecting, why, and who they will share it with.
What to say
“Why do you need my ID number, and how long will you keep it?”
Know your rights
Your data hasrules. Use them.
The Data Protection Act 2019 gives everyone in Kenya five rights over their personal data. Here’s what each one means, what to say, and where to go if someone ignores you.
Ndio, ni wewe.These rights are yours. Mlinzi will show you how.
Section 26 of the Act
5 rights you already have
Each one comes with a line you can copy and send.
2
Nionyeshe data yangu.
Right to access
You can ask any company or institution for a copy of the personal data they hold about you.
What to say
“Please send me a copy of all the personal data you hold about me.”
3
Hapana, asante.
Right to object
You can object to your data being used for things you never agreed to, like marketing.
What to say
“Please stop using my number for marketing. I did not agree to this.”
4
Rekebisha hiyo.
Right to correction
If data about you is wrong, out of date or misleading, you can demand that it gets fixed.
What to say
“Your records about me are wrong. Please correct them and confirm in writing.”
5
Futa hiyo.
Right to deletion
You can ask for false or misleading data about you to be deleted.
What to say
“This information about me is false. Please delete it.”
When it goes wrong
How to report in Kenya
Three steps. Keep screenshots and copies of everything.
Ask them first
Write to the company or institution. Say which right you are using and what you want. Keep a copy.
Give them time
Wait for a response. If they ignore you or refuse without a good reason, move to step 3.
Report to the ODPC
File a complaint online or visit an ODPC office. Attach your messages and any proof.
ODPC offices: Nairobi · Mombasa · Kisumu · Nakuru · Eldoret
Across East Africa
Not in Kenya?
Guides for Uganda and Tanzania are on the way.
Kenya
Data Protection Act 2019. Regulator: Office of the Data Protection Commissioner (ODPC).
Uganda
We’re working on a full guide for Uganda, including how to reach the Personal Data Protection Office (PDPO).
Check back soon.
Tanzania
We’re working on a full guide for Tanzania, including how to reach the Personal Data Protection Commission (PDPC).
Check back soon.
Tips from the crew
One line, one habit
The crew shares these between pages too. Pick one and start today.
Mudata- Data si bundles tu. Your name, ID and face all count.
- Your ID number is personal data. Ficha!
- At the gate, you can ask why they need your ID.
Amani- The Data Protection Act gives you five rights. Use them.
- You can ask any company for a copy of your data.
- Read before you tap “I agree”. Seriously.
Eric- Why does that app need your contacts? Uliza.
- Posting your new house online? Think twice.
- Unknown link in your DMs? Usiclick.
Mlinzi- Never share your OTP. Hata na mama.
- Scammed? Report it to the ODPC. Ni haki yako.
- Before you share data, check the company is registered with the ODPC.
FAQ
Maswali?
We got you.
Is my phone number personal data?
Yes. Anything that can identify you is personal data: your name, phone number, ID number, photos, location and more.
Can a company share my data without asking?
In most cases they need a lawful reason, like your consent or a contract. If you never agreed and there is no good reason, you can object and report it.
Does it cost anything to file a complaint with the ODPC?
No, it’s free. How long it takes to hear back can vary, so keep a copy of your complaint and follow up if you don’t get a response.
What if the person misusing my data is someone I know?
The law covers anyone processing your data for more than purely personal or household use. Keep evidence and talk to the ODPC about your options.
I’m under 18. Do I have these rights too?
Yes. Your data needs extra protection, and organisations generally need a parent or guardian’s consent to process it.
Know how exposed you are?
Take the 1 minute check and get your Privacy Risk Gauge.