This document has been developed to provide a review of the regulatory framework for data protection in Kenya. The report takes a broad view of what constitutes the regulatory framework, going beyond the Data Protection Act, 2019 (DAPA) to include the European General Data Protection Regulation (GDPR) and the California Consumer Protection Act (CCPA).

In May 2017, a special focus in The Economist likened data to the fuel of the future, noting that “data are to this century what oil was to the last one: a driver of growth and change” predicting that the largest conglomerates of the future will be data-driven firms like Google, Tencent, Amazon, and so on, in much the same way the previous century’s oil and manufacturing conglomerates defined the industrial revolution.