Data Protection | Technology | Cross-Border Trade
Introduction
On 8 June 2026 in Brussels, President William Ruto and the European Commission’s Executive Vice-President for technology, Henna Virkkunen pushed the European Union and Kenya to the edge of a data adequacy decision. If it lands, Kenya becomes the first country in Africa to win one. The President set September 2026 as the target. Alongside the talks, Kenya welcomed 102 million euros (about KSh 15.3 billion) under the EU-Kenya Digital Partnership, plus 37 million euros for the Africa leg of the Blue Raman undersea cable linking Djibouti, Somalia, Kenya and Tanzania.
What “Adequacy” Buys You
The rule. Under Article 45 of the European Union General Data Protection Regulation (the GDPR), the European Commission can decide that a country outside the bloc “ensures an adequate level of protection”. Once it does, personal data flows from the bloc to that country without extra paperwork. The effect. European firms can send data to Kenya without standard contractual clauses or other extra transfer mechanisms. That strips cost, delay and legal risk from every contract that touches European personal data. The prize. Kenya already ranks as the world’s 11th most preferred business process outsourcing destination. Adequacy turns Nairobi into a clean, low-friction home for European outsourcing, cloud hosting, fintech and artificial intelligence data work.
The Catch
Adequacy is a one-way gate from Europe to Kenya. It does not switch off Kenya’s own rules. The Data Protection Act, 2019 still governs how data leaves Kenya.
Section 48 of the Data Protection Act, 2019 sets the conditions for transferring personal data out of Kenya. Section 49 requires proof of safeguards before the transfer. Section 50 keeps a localization duty: at least one serving copy of certain personal data must sit on a server inside Kenya. Adequacy will not erase that duty.
The Office of the Data Protection Commissioner, set up under section 5 of the Act, remains the regulator that signs off and enforces.
Your Move
If your business sends personal data to Europe or receives it, the cheapest time to get ready is now, before the decision lands. Start by mapping every cross-border data flow you run. For those whose contracts still rely on the old transfer paperwork, they will need a second look. The conditions in Section 48 and the safeguards in Section 49 are what a regulator will test. Rebuild your data-processing agreements and transfer clauses against them, and run an impact assessment on any high-risk transfer. Mind the localization rule. Confirm where your serving copies sit. Section 50 is a separate duty that adequacy does not displace. Engage the regulator. Register with the Office of the Data Protection Commissioner where thresholds apply, and file your position early as the framework firms up.
Contributors: Thomas Louis, Founding Partner | Basil Ogolla, Trainee Advocate
Prepared by Thomas Louis Advocates for general information only. This is not legal advice.