Kenya: President signed Data Protection Act including cross-border data transfer regulation

On 8 November 2019, the President endorsed the text for the Data Protection Act, 2019. The Act includes provisions that regulate the transfer of personal data outside Kenya. It stipulates that personal data can be transferred internationally if adequate data protection safeguards are in place or with the consent of the data subject. Data controllers or processors must demonstrate to the Data Commissioner that adequate security measures are in place for such transfers. The Act also allows transfers necessary for contractual obligations, legal claims, or public interest, provided that the data subject's rights are protected.