Employee data privacy in Kenya is governed by the Data Protection Act, 2019, which has been in force for over four years, and the Office of the Data Protection Commissioner has moved from awareness campaigns to enforcement. The uncomfortable fact is that most Kenyan employee handbooks still read as if the Act never passed. An HR data protection policy in Kenya is no longer a nice-to-have; it is the piece of the policy pack that decides whether an employee complaint to the ODPC lands on a settlement or a public penalty. This article sets out what the HR policy pack must contain, the six places where employee data moves inside a business, and the retention and registration decisions that employers keep getting wrong.

Why an HR data protection policy in Kenya matters

Four years after the Data Protection Act 2019 came into force, three things have changed on the ground:

• The ODPC is deciding cases and publishing penalties. Administrative fines under section 63 of the Act reach up to KES 5 million, with determinations against Kenyan employers appearing on the regulator's own site.
• Employees know how to complain. A complaint takes ten minutes to file with the ODPC and costs the employee nothing, while the employer is pulled into a response, an investigation and, often, a public finding.
• Data flows out of HR constantly. Payroll vendors, insurance brokers, background-check providers, CCTV contractors, EAP counsellors and parent companies abroad all touch employee data. Each flow needs a lawful basis and, sometimes, a cross-border assessment.

An HR data protection policy is the document that makes those flows defensible. Without it, the employer is relying on goodwill, which the Act does not recognise as a lawful basis for anything.

Six HR touchpoints where employee data moves

Every Kenyan employer touches employee data at the same six points. The HR policy pack must name what happens at each, under what lawful basis, and for how long the data is kept.

• Recruitment. CVs, academic certificates, reference letters, assessment scores, right-to-work checks. Lawful basis is usually legitimate interests before the offer, contract and legal obligation after it.
• Onboarding. National ID, KRA PIN, NSSF and SHIF numbers, bank details, next of kin, medical declarations. Legal obligation and contract are the operative bases.
• Payroll. Bank account, statutory deductions, loans, deductions, M-Pesa numbers. Legal obligation (tax and statutory remittance) and contract.
• CCTV and workplace monitoring. Site cameras, access-control logs, email monitoring, GPS on fleet vehicles. Legitimate interests, with a transparency notice and a necessity test.
• Performance and discipline. Reviews, warning letters, disciplinary hearing records, witness statements. Legal obligation and legitimate interests.
• Exit and references. Final payroll, clearance records, references given to future employers. Legal obligation (statutory record-keeping) and legitimate interests.

Each touchpoint earns its own paragraph in the policy pack, naming the data, the purpose, the lawful basis and the retention period. "We handle employee data carefully" is not a policy; it is a sentiment.

What the HR data protection policy must contain

A compliant HR data protection policy for a Kenyan employer has nine named parts:

• An identity and contact statement. The legal name of the employer as data controller, the physical address and the contact for data-protection enquiries.
• The categories of data processed. The six touchpoints above, with examples.
• The lawful basis for each category. Contract, legal obligation, legitimate interests, consent, vital interests or public interest. Consent is the weakest basis for an employment relationship; the Act treats it as freely given, which it rarely is between an employee and their employer.
• Purpose statements. What each category of data is used for, in plain language.
• Recipients and processors. Payroll vendors, insurers, brokers, auditors, parent companies, any party that touches the data. Each named.
• Cross-border transfer notice. Where the data goes outside Kenya, under what safeguard, and whether an adequacy decision or standard contractual clauses apply.
• Retention periods. Per category. See the next section.
• The rights statement. The five data-subject rights under the Act, and how to exercise them.
• The breach procedure. What happens when the employer identifies a breach, including the 72-hour ODPC notification timeline.

A policy that misses any of these is exposed. A policy that has them all but is written in boilerplate language is also exposed, because the Act expects the notice to be intelligible to the data subject, not to the law firm that drafted it.

Retention periods for HR data in Kenya

Retention is where most HR managers freeze, because the Act itself does not prescribe a single period. The lawful retention period is the shortest of three things: what the statute requires, what the purpose justifies, and what the employer actually needs for a tribunal or audit defence.

• Payroll and tax records. Seven years after the end of the tax period, under the Tax Procedures Act, 2015.
• Employee files. Seven years after termination is the Kenyan convention, aligned to the limitation period for civil claims and NSSF historical queries.
• Unsuccessful candidate CVs. Six months is common. Keep longer only if the candidate agrees in writing to be considered for future vacancies.
• CCTV footage. 30 to 90 days for routine footage; longer only where a specific incident is under investigation.
• Medical records. As long as the Work Injury Benefits Act, 2007 requires, or as long as a pending claim is live.
• Disciplinary records. A finding stays on file until the sanction expires, after which only the fact that a process ran is retained. Spent warnings do not travel with the employee forever.

Retention periods belong in the policy pack as a one-page table. Every HR officer and line manager should be able to find the retention period for any category inside a minute.

ODPC compliance in Kenya: what the regulator expects

The ODPC publishes guidance notes, codes of practice and determinations, and the expectation it has set is practical rather than theoretical:

• A current data-protection policy signed off by the senior-most executive. The policy is dated, versioned and reviewed annually.
• A record of processing activities. The six touchpoints listed above, written as a register with the lawful basis, recipients and retention for each. The Act's accountability principle expects this register to exist, not just the policy that describes it.
• A data-protection officer or a named lead. Not every employer must appoint a Data Protection Officer in the technical sense, but every employer needs a named person responsible for compliance, who can answer the ODPC's correspondence within the deadlines set.
• Transfer safeguards for cross-border flows. A group that routes payroll, performance or engagement data to a parent company in India, the UK, the United States or South Africa needs to document the safeguard.
• A breach register and a response plan. Logged incidents, root-cause notes and the 72-hour notification pathway.

The regulator's enforcement focus is accountability, not perfection. An employer who has the policy, the register, the named lead and the breach plan has a defence even when something goes wrong. An employer with none of those has no defence at all.

Data controller registration in Kenya: when and how

The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 set the registration regime. The important points for a Kenyan employer:

• Mandatory registration thresholds. The Regulations tie registration to turnover and headcount, with specific categories of processing (health, children, credit, surveillance) always required to register. ODPC publishes the current threshold and the categories on its site at odpc.go.ke.
• Where registration applies. The data controller is the legal person that decides the purposes and means of processing. For most Kenyan employers that is the company itself, not the HR officer.
• Separate processor registration. Payroll vendors and HR outsourcing firms that process employee data on the employer's behalf register separately as data processors.
• The certificate. A registered controller receives a certificate which is renewed on the schedule the Regulations set. The certificate is the document the ODPC asks for when a complaint lands.
• Non-registration is a visible failure. Of the three documents a regulator checks (policy, register of activities, certificate of registration), the certificate is the one that is easiest to prove is missing.

Registration is a separate step from building the policy pack. Both must be in place.

Frequently asked questions

Does an HR data protection policy in Kenya have to be a standalone document?

It does not have to be, but it reads more clearly when it is. The HR data protection policy can sit inside a wider data protection policy for the organisation, but employees need a version written for them, in the language they speak, that names the HR touchpoints specifically. Burying it inside a 40-page corporate document defeats the point of the Act's transparency requirement.

Can we use consent as the basis for processing employee data in Kenya?

In most cases, no. The ODPC has followed the European position that consent given in an employment relationship is rarely freely given, because the power imbalance is real. Rely on contract, legal obligation and legitimate interests for the main categories. Reserve consent for genuinely optional processing, such as photography for marketing, where the employee can say no without consequence.

What is the fastest way for a Kenyan employer to get compliant?

Write the record of processing activities first. The register forces an honest look at every data flow and surfaces the gaps. The policy, the retention table and the registration certificate all follow from it. Attempting the policy first, without the register, usually produces a document that sounds right and misses half the touchpoints that actually exist.

Conclusion

The Data Protection Act, 2019 did not make HR more complicated; it made HR's existing data obligations explicit. An HR data protection policy in Kenya is the document that records what the business already does, maps it to a lawful basis, and makes the retention and transfer decisions visible. Employers who treat it as a tick-box exercise are the ones who end up on an ODPC determination; employers who build the register, write the policy against it and register as a controller are the ones who answer a complaint in a week and close it without a penalty.

Before engaging a firm to draft this pack, see our review of the top HR consultancy firms in Kenya for HR policy development. ACCUREX writes HR policies and procedures for Kenyan employers, with data protection built into the drafting rather than bolted on at the end.

Audit your HR data protection policy with ACCUREX

Start with a review of your current HR policy pack against the Data Protection Act, 2019 and the ODPC's published guidance. An ACCUREX consultant will read what you have, map it against the six HR touchpoints, and come back with the gaps and the fastest route to compliance.

Contact ACCUREX today to book a free policy review. Call +254 715 767 676, email info@accurex.co.ke, or use the button below to send your brief.

Talk to a consultant