Kenya: Office of the Data Protection Commissioner closes consultation on draft Guidance Note on Data Protection Officer

On 15 May 2026, the Kenya Office of the Data Protection Commissioner closes the consultation on the draft Guidance Note on Data Protection Officer. The draft Guidance Note applies to all data controllers and data processors across all sectors, and the Kenya Office of the Data Protection Commissioner issues the draft Guidance Note under Section 24 of the Data Protection Act No. 24 of 2019. The draft Guidance Note would set out the circumstances requiring the designation or appointment of a Data Protection Officer (DPO), covering processing by public or private bodies, processing operations requiring regular and systematic monitoring of data subjects, and processing of sensitive personal data. The draft Guidance Note would further specify that a DPO may be a staff member, shared across a group of entities or public bodies subject to conditions on accessibility, organisational structure, and operational independence, or outsourced to an external appointee provided the DPO remains independent and has no conflict of interest. The draft Guidance Note would additionally address the roles and responsibilities of the DPO, including advising the data controller or data processor and their employees, ensuring compliance with the Data Protection Act No. 24 of 2019, facilitating capacity building, providing advice on Data Protection Impact Assessments, and cooperating with the Data Commissioner, as well as DPO qualifications, reporting structure, and the requirement to publish DPO contact details on the organisation's website and communicate them to the Data Commissioner.