Data Processing Agreement in Kenya: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) is the contract that governs what a service provider may do with personal data it handles on behalf of another organisation. In Kenya a DPA is not just good practice, it is required: the Data Protection (General) Regulations 2021 call for a written contract between a data controller and a data processor. This guide explains when you need a DPA, what the law requires, and the clauses to include. It is written for legal, privacy and procurement teams. It is general guidance, not legal advice, and you should confirm the current position with a qualified Kenyan advocate. ## What a DPA is and when you need one Two roles matter under Kenyan data protection law. The data controller decides why and how personal data is processed. The data processor processes that data on the controller's behalf, for example a cloud host, a payroll bureau or a marketing platform. Whenever a controller gives personal data to a processor, a written DPA should govern the relationship. It can be a standalone contract or a schedule to a services agreement. Its job is to keep the processor inside the controller's instructions and keep the data protected. ## The law that applies in Kenya - Data Protection Act 2019 (No. 24 of 2019). This is the main data protection statute, enforced by the Office of the Data Protection Commissioner (ODPC). It sets the principles and the rights of data subjects.

• Data Protection (General) Regulations 2021. These Regulations fill in the detail. Regulation 24 covers the contract between a data controller and a data processor, and Regulation 25 sets out the obligations of a data processor. So a written DPA with specific terms is expected by law where processing is outsourced.
• Registration. The ODPC maintains a register of data controllers and data processors, and registration obligations apply to many organisations.
• Cross-border transfers. The Act and Regulations govern transfers of personal data outside Kenya, and some categories of data may need to be processed within Kenya, so a DPA should address where data is held. ## Key clauses to include ### Subject matter and scope Describe the personal data processed, the categories of data subjects, the nature and purpose of the processing, and its duration. ### Processing only on instructions The processor must process the data only on the controller's documented instructions, and not for its own purposes. ### Confidentiality Everyone the processor allows to handle the data must be bound by confidentiality. ### Security measures Set out the technical and organisational measures the processor must maintain, in line with the security duties under the Act and Regulation 25. ### Sub-processors State whether sub-processors are allowed, that the controller's authorisation is needed, and that the processor must flow down the same obligations and stay responsible. ### Assisting the controller The processor should help the controller respond to data subject requests and meet its own duties, including security and breach handling. ### Breach notification Require the processor to notify the controller without undue delay after becoming aware of a personal data breach, so the controller can meet its ODPC notification duties. ### Return or deletion and audit At the end of the service, the processor must return or delete the data at the controller's choice. Give the controller a right to audit or receive evidence of compliance. ### Location and transfers Say where the data is processed and set the rules for any transfer outside Kenya, which the Act and Regulations govern. ## A simple structure to follow 1. Parties and roles (controller and processor)

2. Details of processing (data, subjects, purpose, duration)
3. Processor obligations and instructions
4. Confidentiality
5. Security measures
6. Sub-processors
7. Assistance, data subject rights and breach notification
8. Return or deletion of data and audit rights
9. Data location and international transfers
10. Liability and governing law ## Common mistakes to avoid - No written DPA at all, which Regulation 24 requires where processing is outsourced.

• Letting the processor use the data for its own purposes without limits.
• Silence on sub-processors, breaking the chain of responsibility.
• No breach notification timetable.
• Ignoring where the data is held and the rules on transfers outside Kenya. ## Keeping the agreement and its obligations in one place A DPA creates obligations that run for the whole life of the service: security standards to maintain, sub-processors to track, breach timelines to meet and deletion duties at the end. These slip when the signed DPA sits in a folder while the obligations live in someone's memory. The idea behind a single AI contract workspace is to hold the agreement and its duties together: draft and review the DPA, flag the data protection obligations inside it, and track key dates and tasks in one place rather than across email and spreadsheets. Adira is one such workspace. It is built around Indian corporate law first, and support for other jurisdictions, including Kenya, is on its roadmap, so treat the points above as a starting position to confirm with a qualified Kenyan advocate.