Data Protection Act Kenya for Fintech Marketers (2026)

Most fintech marketing in Kenya now runs on personal data: lead forms, SMS lists, Customer Match uploads and pixel audiences. The law decides which of those you can use, and how.

The Data Protection Act Kenya passed in 2019 (No. 24 of 2019, in force from 25 November 2019) governs how any business uses personal data about people in Kenya. If you came for the Act itself, the full text is linked in the sources at the end. This guide is for the people who build the funnel: the growth lead running lead forms, SMS and paid social for a business licensed by CBK, CMA, IRA or SASRA.

It covers what the Act and its 2021 regulations say about consent, retargeting, opt-outs and registration, with every rule tied to its section. It is not legal advice. Where the text leaves a question open, this guide says so rather than guessing. Hand it to your data protection officer and check what matters to you against the sources listed at the end.

What the Data Protection Act Kenya requires of a marketer

Section 30 lets you process personal data only on a lawful basis: consent, or necessity for one of the listed purposes, such as performing a contract or a legitimate interest that does not override the person’s rights.

Marketing sits under a stricter rule. Section 37(1) says no one may use personal data for commercial purposes unless they have obtained express consent, or a written law authorizes the use and the person was told about it when the data was collected. Section 37(2) adds that the data should be anonymized where possible.

The Data Protection (General) Regulations 2021, Legal Notice 263, set out what commercial purposes cover. Under regulation 14(2), direct marketing includes:

• sending a catalog to a person through any medium;
• displaying an advertisement on an online media site where the person is logged on using their personal data; and
• sending an electronic message about a sale, or other advertising material relating to a sale, using data the person provided.

Regulation 14(3) draws the other edge. Marketing is not direct where personal data is not used or disclosed to identify or target particular recipients. A contextual ad on a page about savings rates sits outside the rule; a Customer Match campaign built from your CRM sits inside it.

Legitimate interest under section 30 does not get you past section 37. The ODPC’s guidance note for digital credit providers (December 2023) gives the example of a lender marketing a new product to existing customers, and says that processing needs consent.

Lead forms: consent that holds up when someone complains

The Act defines consent as an express, unequivocal, free, specific and informed indication of the person’s wishes, given by a statement or a clear affirmative action (s.2). Under section 32(1), the business carries the burden of proving it.

Before collecting, section 29 requires you to tell the person, as far as practicable, why you are collecting their data, who else will receive it and with what safeguards, and what their rights are, among other things. Where consent is the basis, regulation 4(1) adds that the request must explain, among other things, who the controller is, each purpose, the data used, any automated decision-making, the risks of transfers without safeguards, any third parties, the right to withdraw, and what giving, withholding or withdrawing consent means.

Regulation 4(4) lists when consent is not freely given. Three cases apply directly to lead forms:

• it is presumed because the person did not object (a pre-ticked box is the obvious example);
• it is a non-negotiable part of the terms and conditions;
• several purposes are merged without specific consent for each.

The ODPC’s digital-lender guidance makes the same point in plain terms: accepting the terms and conditions does not amount to consent, and consent forms should sit apart from the terms.

At minimum, a lead form that meets this has:

• a short notice above the submit button naming your company, the purpose, and who receives the data (your CRM and your ad platforms);
• one unticked box per purpose, for example marketing by SMS, email or WhatsApp, and sharing with partners;
• a link to the privacy policy that explains the person’s rights and how to withdraw consent;
• a stored record of what the person saw and ticked, with a timestamp, because the burden of proof is yours.

If your landing pages also go through legal review for advertising rules, our guide to landing page compliance covers that layer.

Retargeting, Customer Match and the logged-in rule

Regulation 14(2)(b) is the line that matters most for paid social. An ad shown to someone logged in to Facebook, Instagram, YouTube or LinkedIn, and chosen because of their personal data, is direct marketing. That covers at least:

• Customer Match and custom-audience uploads of phone numbers or emails;
• re-engagement audiences built from your CRM or loan-application records;
• less directly, lookalike audiences: the ad goes to strangers, but uploading the seed list is still a commercial use of your customers’ data under section 37.

Each of these needs the consent described above, collected for that purpose.

Pixel-based retargeting is less clear-cut. The regulations name “information associated with web browsing” as a source of indirectly collected data (reg. 6(1)(d)), and regulation 6(3) requires you to tell the person within 14 days when you collect data that way. Whether a pixel audience shown to a logged-in user falls under regulation 14(2)(b) turns on facts the regulation does not spell out, and we could not find an ODPC determination on the point that we could read for this guide. Treat it as consent territory until your counsel says otherwise.

Three obligations follow every audience you build:

• Objection is absolute. Under regulation 8(4), the right to object to direct marketing, including profiling related to it, cannot be overridden. Regulation 8(3) gives you 14 days to comply.
• Third-party marketing stops within seven days. A request to stop sharing data for another party’s direct marketing must be honored within seven days, free of charge (reg. 18(3)).
• Suppression must reach the ad platforms. Once someone objects, their data must not be processed for direct marketing (reg. 8(5)). A customer who opted out but still sits in a Customer Match list is still being used for direct marketing.

Where Meta or Google processes uploaded customer data outside Kenya, the upload is also a cross-border transfer. Section 48 and regulations 40–41 require a basis (appropriate safeguards, an adequacy decision by the Data Commissioner, necessity or consent), and a transfer that relies on safeguards must be documented with its date and time, recipient, justification and a description of the data (reg. 41(2)).

Opt-outs on every message

Regulation 15(2) bars sending direct marketing by any means unless the message tells the person where to send a request to stop, without charge. Regulation 16 requires the opt-out to be visible and clearly explained, quick to use, offered through a direct and accessible channel, free or of nominal cost, and accessible to people with disabilities.

Regulation 17 requires each message to point out the opt-out prominently, and gives ways to do it, including a one-word reply to an SMS or in an email subject line, a prominent link to a subscription center in an email, and a verbal opt out on calls. Whatever preferences you offer, one of them must be opting out of all future direct marketing (reg. 17(4)).

For email, regulation 15(3) forbids disguising who a message is from, leaving out a valid address for stop requests, or using automated calling systems without human intervention.

Using personal data for commercial purposes without consent is also an offence under regulation 15(4), with a fine of up to KES 20,000 (≈US$154), up to six months in prison, or both. The administrative fines below are far larger.

ODPC registration: why size doesn’t exempt a fintech

Section 18 says no one may act as a data controller or processor unless registered with the Data Commissioner. The Registration Regulations 2021 (Legal Notice 265) exempt small organizations with annual turnover below KES 5 million and fewer than ten employees (reg. 13(2)).

That exemption does not apply to anyone processing data for a purpose in the Third Schedule (reg. 13(4)). Item 8 is the provision of financial services. Item 10 is businesses wholly or mainly in direct marketing. For a fintech, ODPC registration is required however small the team, and the ODPC’s digital-lender guidance says the same of digital credit providers.

For lenders, registration is also tied to the license. The Central Bank of Kenya Act requires an applicant for a non-deposit-taking credit license to provide a certificate issued under section 19 of the Data Protection Act (s.33S(3)(d)), and lets CBK suspend or revoke the license where the licensee is in breach of that Act (s.33S(7)(b)). A careless SMS campaign can become a licensing problem, not only a data protection one.

A certificate lasts 24 months (reg. 9). Processing without registering, or after a certificate expires, is an offence (reg. 18).

Kenya Data Protection Act 2019 penalties and enforcement

The ODPC has three main tools under the Kenya Data Protection Act 2019:

• Enforcement notice (s.58): it names the breach and the fix, with at least 21 days to comply. Failing to comply without reasonable excuse is an offence carrying up to KES 5 million, two years in prison, or both (s.58(3)).
• Penalty notice (ss.62–63): up to KES 5 million (≈US$38,500) or, for an undertaking, 1% of the previous year’s turnover, whichever is lower.
• Compensation (s.65): anyone who suffers damage from a breach can claim it, and damage includes distress, not only financial loss.

The ODPC’s first penalty notice shows how a marketing slip escalates. In December 2022 it fined Oppo Kenya KES 5 million: the company had used a complainant’s photo in its Instagram stories without consent, then failed to comply with the enforcement notice that followed. The ODPC’s release cites section 37, the same commercial-use rule that governs your audiences.

The ODPC also publishes its complaint determinations on its website. We have not quoted any here because the published copies are scanned images we could not read in full while writing this guide.

FAQ: data protection rules for fintech marketing in Kenya

Data protection act Kenya: what to do next

Start with the three checks that catch most problems: confirm your ODPC registration is current, make sure every lead form collects separate marketing consent with a stored record, and connect your opt-out list to every ad-platform audience. Then document where your data goes outside Kenya.

The data protection act Kenya rules sit alongside the advertising rules your own regulator sets. For how CBK, CMA, IRA and SASRA treat the ad itself, see our guide to who approves a fintech ad. For how we run compliant paid campaigns for regulated Kenyan fintechs, see our fintech PPC service, or get in touch.