Kenya Data Protection Act and Payment Data Storage

The Kenya Data Protection Act 2019 defines personal data broadly — any information relating to an identified or identifiable natural person. In your Paystack integration, this includes:

• Customer name, email address, and phone number
• Transaction reference linked to a specific customer
• IP address at time of payment
• Device identifiers collected during checkout
• Any metadata you attach to transactions (e.g., member ID, order contents)

You are both a data controller (you decide what to collect and why) and in some cases a data processor (if you handle data on behalf of another business). Both roles require ODPC registration.

The lawful basis for storing payment data is performance of a contract (DPA Section 30(1)(b)) — you need the data to fulfill the purchase agreement with your customer. You do not need a separate consent tick-box for this, but you must disclose it in a privacy notice.

1. ODPC Registration
Register with the Office of the Data Protection Commissioner at odpc.go.ke. Registration is required for any data controller or processor. The fee and process are set by the ODPC regulations.

2. Privacy Notice
Before a customer pays, they must be able to access a privacy notice explaining: what data you collect at checkout, the lawful basis, how long you retain it, and how they can exercise their rights (access, rectification, erasure).

3. Data Protection Impact Assessment (DPIA)
Conduct a DPIA before deploying a payment system that processes personal data at scale or uses automated decision-making. Document the assessment and retain it.

4. Security Measures
Implement appropriate technical and organisational measures: encrypt data at rest and in transit, restrict access to payment tables, maintain audit logs of who accesses payment records.

5. Breach Notification
If your payment database is breached:

• Notify the ODPC within 72 hours of becoming aware of the breach
• Notify affected data subjects (customers) as soon as reasonably practicable
• Document the breach and remediation steps in your breach register

6. Data Retention and Deletion
Define a retention period. For financial records in Kenya, 5-7 years is common to align with KRA requirements. After this period, delete or anonymise customer payment records.

This guide is part of the Paystack security and compliance guide.

Sign up for the McTaba newsletter