Lawful basis and purpose
Process identity data only for a defined, lawful purpose such as meeting AML obligations.
All regulations
Kenya / Office of the Data Protection Commissioner (ODPC)
Data Protection Act, 2019
The Act governs all processing of personal data in Kenya. KYC handles some of the most sensitive data there is: ID documents, faces and biometric data, which the Act treats as sensitive personal data with stricter rules.
Who it applies to
Industries
Key requirements
Registration
Register with the ODPC as a data controller or processor where required.
Impact assessments
Carry out a data protection impact assessment for high-risk processing such as biometric verification.
Retention and security
Keep data no longer than needed, protect it, and notify the ODPC of a breach within 72 hours.
Transfers abroad
Have appropriate safeguards before sending identity data outside Kenya.
How Sentinel helps
- Only the evidence the check needs is collected.
- Role-based access to identity data and media.
- Retention controls so records are purged when no longer required.
Related reading
23 October 2026 · 4 min read
Digital lenders in Kenya: identity, licensing and data protection
Lending apps now sit under CBK licensing and active data protection enforcement. Here is what that means for identity checks in the loan flow.
Read the article 23 October 2026 · 4 min readDeepfakes and remote onboarding: what a liveness check has to prove
Face-swap video and replay attacks are now cheap. What institutions should expect from liveness and document checks, and why the record matters as much as the result.
Read the articleGeneral information, not legal advice. Last reviewed October 2026. Requirements change, so confirm the current position with the regulator or your counsel before relying on it.