Kenya Data Protection Act Considerations for Payment KYC

The Kenya Data Protection Act, 2019, came into effect to regulate the processing of personal data. It applies to any organization that processes personal data of individuals in Kenya, regardless of where the organization is based.

When you call Paystack Resolve Account Number for a Kenyan bank account, you are processing personal data: the account holder's name. When you run BVN or equivalent identity verification, you are processing sensitive personal data.

Key terms you need to know:

• Data controller: You, the organization that decides why and how personal data is processed. If you call Paystack identity APIs, you are the data controller.
• Data processor: Paystack, which processes data on your behalf when you call their APIs.
• Data subject: Your user, the person whose data is being verified.
• Personal data: Any information relating to an identified or identifiable person. Account names, phone numbers, and identity numbers all qualify.

The Act establishes eight data protection principles that apply to every piece of personal data you collect through identity verification.

The Act requires consent to be freely given, specific, informed, and unambiguous. Here is what that means for KYC verification.

Freely given: The user must have a genuine choice. If you refuse all service unless they complete KYC, the consent may not be considered freely given for lower-risk services. Let users access basic features without full KYC.

Specific: Consent for bank account verification is not consent for BVN verification. Each verification type needs its own consent. Do not bundle everything into one "I agree to all verification" checkbox.

Informed: Tell the user what data you will check, who will process it (you and Paystack), why you need it, how long you will keep the results, and their rights regarding the data.

Unambiguous: An explicit action like clicking "Verify my account" is unambiguous. Pre-checked checkboxes or passive scrolling past a notice are not.

// kenya-consent-example.js
var consentText = 'I authorize [Your Company Name] to verify my bank account details ' +
  'through Paystack for the purpose of enabling withdrawals. ' +
  'My account name will be retrieved from my bank and stored securely for up to 30 days. ' +
  'I can request access to or deletion of this data at any time by contacting support.';

// Only proceed after user explicitly accepts
if (userClickedVerifyButton && consentGiven) {
  await logConsent(userId, 'bank_verification', consentText, userIp);
  await resolveAccount(accountNumber, bankCode);
}

The Kenya DPA has provisions regarding cross-border transfer of personal data. Personal data can be transferred outside Kenya only if the receiving country has adequate data protection laws, or if the data subject consents to the transfer, or if the transfer is necessary for the performance of a contract.

What this means for your infrastructure:

• If your database is hosted in a country with adequate data protection (the ODPC maintains a list), you may be fine. Many EU countries qualify.
• If your database is in a country without adequate protection, you need explicit consent from the user for the cross-border transfer, or you need to implement appropriate safeguards.
• Paystack processes data in accordance with their own data protection policies. Review their Data Processing Agreement (DPA) to understand where they store data.

Practical recommendation: If you serve primarily Kenyan users, host your database in a region that the ODPC recognises as having adequate protection. Cloud providers like AWS, Google Cloud, and Azure offer regions in or near Africa. If you use a Nairobi or Johannesburg region, you reduce cross-border transfer concerns.

The ODPC (Office of the Data Protection Commissioner) oversees compliance with the Act. Data controllers and processors that meet certain criteria must register with the ODPC.

Who must register: The Act and subsequent regulations specify registration requirements based on the nature and scale of data processing. If you process personal data of Kenyan individuals as part of your core business (which includes KYC verification for financial services), you should assess whether registration is required.

How to register: Visit the ODPC website, submit a registration application, pay the registration fee, and receive a certificate of registration. The process is online.

Annual compliance: Registration is not a one-time event. You must renew and may need to conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities. KYC verification that involves sensitive data like identity numbers may qualify as high-risk.

Do not skip this step. Operating without registration when it is required exposes you to penalties. The ODPC has enforcement powers including fines.

A Data Protection Impact Assessment (DPIA) is required when your data processing is likely to result in high risk to data subjects. Identity verification often qualifies.

When a DPIA is likely required:

• You are verifying identity using sensitive data (national ID numbers, BVN equivalents).
• You are processing data of a large number of data subjects.
• You are using the data for automated decision-making (e.g., auto-approving or rejecting based on verification results).

What a DPIA covers:

1. Description of the processing activity (what identity data you collect, from where, how it flows through your system).
2. Purpose and necessity (why you need this data, whether you could achieve the same goal with less data).
3. Risks to data subjects (what happens if the data is breached, misused, or incorrect).
4. Mitigation measures (encryption, access controls, retention policies, consent logging).

If you have not conducted a DPIA for your KYC flow, do it before launching or as soon as practical. It forces you to think through the risks and demonstrates to the ODPC that you take compliance seriously.

The Act gives data subjects several rights. You must respond to requests within 30 days.

Access requests: "What verification data do you have about me?" Compile all identity verification data for the user: verification results, timestamps, cached account names, and consent records. Present it in a clear format.

Correction requests: "My name is wrong in your records." If the cached account name is outdated (the user changed their name at the bank), invalidate the cache and re-run the verification. Update your records with the correct data.

Deletion requests: "Delete my verification data." If no regulatory requirement mandates retention, delete it. If financial record-keeping laws require you to keep it, explain the retention period to the user and delete it when the period expires.

Objection to processing: "I do not want my data verified anymore." Respect this. Disable verification for the user and downgrade their KYC tier. They lose access to features that require verification, but they retain access to basic features.

Build a process, not a one-off response. Data subject requests will come. Have a documented process: who handles them, how they are verified (make sure the requester is actually the data subject), and how responses are tracked.

Use this checklist to assess your KYC flow against the Kenya DPA requirements.

• Consent: Is consent specific, informed, and explicit for each verification type?
• Purpose limitation: Is verification data used only for the stated purpose (KYC, payout verification)?
• Data minimization: Are you storing only what you need? No raw BVNs if you only need the result?
• Accuracy: Can users update their data? Can you re-verify when details change?
• Retention: Is there a defined retention period? Is there an automated deletion process?
• Security: Is personal data encrypted at rest? Are access controls in place?
• Data localization: Is data stored in Kenya or a country with adequate protection?
• ODPC registration: Have you registered if required?
• DPIA: Have you conducted a DPIA for your KYC processing?
• Data subject requests: Can you handle access, correction, and deletion requests within 30 days?
• Breach response: Do you have a plan to notify the ODPC and affected users within 72 hours of a breach?

For the broader data protection principles that apply across African jurisdictions, see the data protection duties guide.