This document has been developed to provide a review of the regulatory framework for data protection in Kenya. The report takes a broad view of what constitutes the regulatory framework, going beyond the Data Protection Act, 2019 (DAPA) to include the European General Data Protection Regulation (GDPR) and the California Consumer Protection Act (CCPA).