The Data Protection Act 2019 applies to every agent that processes personal data in Kenya, and it includes a right not to be subject to solely automated decisions with significant effects. Sector regulators add their own rules: the Central Bank of Kenya, the Capital Markets Authority and the Insurance Regulatory Authority.
Who regulates an agent in Kenya?
| Body or law | Remit | Relevance to an agent |
|---|---|---|
| Data Protection Act 2019, Office of the Data Protection Commissioner | Personal data across sectors | Lawful processing, rights, automated decisions, impact assessments, transfers |
| Central Bank of Kenya | Banks, payment service providers and other supervised lenders | Governance, outsourcing, customer protection |
| Capital Markets Authority | Securities and investment firms | Conduct and suitability |
| Insurance Regulatory Authority | Insurers and intermediaries | Fair treatment, claims handling |
What does the Data Protection Act require, in substance?
The Act applies to data controllers and data processors handling personal data of people in Kenya. In substance it requires:
- Registration of controllers and processors with the Data Protection Commissioner, subject to thresholds.
- Lawful processing under principles similar to GDPR's: lawfulness, purpose limitation, minimisation, accuracy, storage limitation and security.
- Protection from solely automated decisions: people have a right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, subject to exceptions with safeguards.
- Data protection impact assessments where processing is likely to result in high risk.
- Conditions on transfers of personal data outside Kenya.
- Breach notification to the Commissioner and, where there is a real risk of harm, to the people affected.
Sector regulators then expect firms to govern technology, manage outsourcing and treat customers fairly. The reasoning behind both layers is the same: the firm stays accountable for what its agents do.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where does the line fall for an agent?
Digital lending and mobile payments are central to Kenyan financial services, and that is where agents are most likely to make decisions with significant effects. An agent that sets a digital loan limit, declines a loan or suspends a wallet is making exactly the kind of decision the Act's automated decision right addresses.
- Agent may: answer customer questions in English and Kiswahili, collect KYC documents, monitor transactions, draft collections messages from approved templates, process routine requests.
- Agent may, within limits: approve small loan limit increases within a tested policy, with safeguards and a route to human review.
- Stays with a person: declines and limit reductions where the customer requests review, suspension of accounts or wallets, any contact with customers in hardship beyond approved templates, and decisions on suspected fraud.
An illustrative example
Take a Kenyan digital lender that uses an agent to set and adjust loan limits based on repayment history and mobile money activity. Customers whose limits are cut receive a text message with no explanation.
Under the Data Protection Act, each cut is a solely automated decision with a significant effect. The lender changes its design: limit cuts now come with a short reason and a way to request review, reviews are handled by a credit officer who can restore the limit, and the lender completes an impact assessment covering the agent. It also checks whether its model provider processes data outside Kenya and puts the transfer on a lawful footing. Every limit decision is recorded with the factors used, so reviews can be done properly.
Which controls meet Kenyan rules?
- Registration with the Data Protection Commissioner where required, listing agent processing.
- An impact assessment for agents that profile or decide.
- Reasons and a review route for automated decisions with significant effects.
- Transfer checks for platforms and model providers outside Kenya.
- Outsourcing assessments to meet sector regulators' expectations.
- Decision records that capture factors and sources.
Banks will recognise much of this from model risk practice; see model risk rules already cover AI agents. For comparison, see which Indian rules apply to AI agents in banking and which Mexican rules apply to AI agents in finance. The full map is in AI agent regulation, mapped to controls.
Where Pryme fits
In Pryme, a capability such as cutting a loan limit can be set to execute within the customer's own limits or to be held for a named person, and every verdict is filed with the facts relied on. That record is what a customer's request for review needs.
Questions people ask
Does the Data Protection Act apply to foreign companies?
It applies to controllers and processors who process personal data of people in Kenya, including some established outside the country. Check registration and transfer duties if your agent serves Kenyan customers.
Is consent needed for an agent to process data?
Not always. The Act provides several lawful bases, including contract and legal obligation. Consent is one option and must be freely given if relied on.
Are agents in mobile money regulated differently?
The same data protection rules apply. Payment service providers also follow the Central Bank of Kenya's requirements, which focus on governance, security and customer protection.