Kenya Data Protection Act 2019: commercial use and direct marketing
Kenya's Data Protection Act (No. 24 of 2019) is supported by the Data Protection (General) Regulations, 2021 (Legal Notice No. 263, Kenya Gazette Supplement No. 236, 31 December 2021), published by the Office of the Data Protection Commissioner (ODPC).
What counts as commercial use (regulation 14)
Regulation 14 treats personal data as used for commercial purposes where it is used to advance commercial or economic interests, including inducing someone to buy, rent, subscribe to or exchange products or services. Sending an electronic message about a product to a data subject, using personal data the data subject provided, is listed as direct marketing.
Direct marketing conditions (regulation 15)
Regulation 15(1) lists conditions for using personal data (other than sensitive personal data) for direct marketing, including collecting it from the data subject, telling them direct marketing is a purpose, their consent, and a simplified opt-out mechanism. Every direct-marketing message must say where the person can ask, free of charge, to restrict such messages (reg 15(2)). Email marketing must not disguise the sender and must give a valid address for stopping messages (reg 15(3)). Using personal data for commercial purposes without consent is an offence (reg 15(4)).
Regulation 16 requires the opt-out to be visible, clear and quick to use.
A practical first step
If an AI tool helps you target, write or send marketing, record which tool it is, which personal data it uses, and how people opt out. Keeping a list of your AI systems makes this easier to show.
Official source
Start free: EURO AI Register (1 AI system free; $19/month or $190/year). It is a record-keeping tool. It is not legal advice and not a certification.
Accountant or tax practitioner? See the partner programme.
General information, not legal advice. Checked against the official texts linked above on 14 October 2026; read the law itself or ask a qualified adviser before acting.