KDPA 2019 (Kenya)
Overview
| Field | Value |
|---|---|
| Pack ID | kenya/kdpa |
| Full title | Kenya Data Protection Act 2019 |
| Regulator | Office of the Data Protection Commissioner (ODPC) |
| Jurisdiction | Kenya (KE) |
| Effective date | November 2019 |
Pack ID vs. file path
The pack ID used in the SDK is kenya/kdpa, but the underlying Rego file lives at comply54/packs/africa/kdpa.rego for historical reasons. These are two different identifiers:
# ✅ Correct — use the pack ID, not the file path
from comply54 import KenyaDataComplianceCompliance
# or explicitly:
from comply54.core.packs import KDPA # pack_id = "kenya/kdpa"
# ❌ Silently broken — "africa/kdpa" is not a registered pack ID
compliance.check(action="export_data", params={}, pack_ids=["africa/kdpa"])
# Returns no violations — the pack was never evaluated
The SDK does not error on an unrecognised pack ID — it silently evaluates nothing. If you reference "africa/kdpa" directly, your checks will always return allow with no violations logged.
What comply54 enforces
Cross-border transfers (§48)
KDPA §48 restricts cross-border transfers of personal data to countries that provide adequate protection. Biometric data exports are prohibited entirely.
| Destination | Data type | Decision |
|---|---|---|
| Kenya | Any | allow |
| EAC / AU adequacy partner | Non-sensitive | allow |
| Non-adequate country | Personal data + consent | escalate |
| Non-adequate country | Personal data, no consent | deny |
| Any country | Biometric (KRA PIN, passport) | deny |
Consent requirements (§30)
result = compliance.check(
action="export_data",
params={"destination_country": "US", "data_type": "customer_pii"},
context={"consent_documented": False},
)
# decision: deny
Special categories (§46)
Health data, genetic data, and biometric data receive heightened protection — always deny for cross-border transfer.
Input fields used
| Field | Path | Description |
|---|---|---|
| Action | input.action | "export_data", "send_to_external", "store_data" |
| Destination country | input.params.destination_country | ISO 3166-1 alpha-2 |
| Data type | input.params.data_type | "biometric", "customer_pii", "health" |
| Consent documented | input.context.consent_documented | Boolean |
Messages returned
KDPA 2019 §48: Cross-border transfer to US requires consent or adequacy confirmation
KDPA 2019 §46: Biometric data export prohibited — special category data
KDPA 2019 §30: Processing personal data without consent — legal basis required