The Office of the Data Protection Commissioner (ODPC) recently published its Guidance Notes for Cross-border Data Transfers. This comes after the consultation that took place in April of 2026. Cross-border transfer of data involves transmission, access or making available data across multiple jurisdictions, occurring when businesses operate in multiple jurisdictions or when individuals share data with entities outside their country.[1] The Note has been developed to assist data controllers, those that determine the purpose and means of processing data, and data processors, who process personal data on behalf of the data controller, to understand their obligations when transferring personal data.[2]
Cross-border transfer of personal data is a frequent target of cyberattacks, data breaches, phishing, ransomware attacks and account takeovers. Therefore, the Guidance Note ensures that data is protected when it leaves Kenya.[3] This includes putting in place appropriate safeguards to transfer personal data; the Note provides what entities should include in standard clauses for legal instruments containing appropriate safeguards for controller-to-controller transfers and controller-to-processor transfers.[4] The Guidance Note identifies four principal bases for cross-border transfers: appropriate data protection safeguards, an adequacy decision, necessity and consent; this helps organisations determine whether the transfer is lawful.[5]
Binding Corporate Rules (BCRs), internal rules adopted by corporations to regulate intra-group transfer of personal data, are to be added as appropriate safeguards for cross-border data transfer. To satisfy the Note’s requirements BCRs must be legally binding across all group entities and employees, define clear processing scopes, establish internal complaint-handling mechanisms, accept liability for breaches and obtain formal approval from the ODPC. The corporate groups must notify the Data Commissioner of any material structural or policy changes and enforce continuous oversight through regular compliance audits.[6]
Under data localisation requirements, personal data processed for strategic interests including civil registration, public finances, elections, basic education, primary or secondary healthcare, and designated critical infrastructure must be domiciled in Kenya by using local servers and data centers or maintaining at least one local serving copy.[7] Hosting personal data on cloud storage servers outside Kenya is international data transfer and organisations must perform vendor due diligence, execute data processing agreements and enforce technical security measures including retaining audit logs, encryption at rest and in transit Multi-Factor Authentication (MFA), datasets anonymisation and offline backup recovery protocols.[8]
The Guidance Note requires organisations to document transfers, including recipients, justification, data, time and description of the data transferred. Where processing involves high-risk cross-border transfers, organisations are required to conduct data protection impact assessments (DPIA) prior to deployment to evaluate foreign legal frameworks, data flows and risk mitigations.[9] For onward transfers, subsequent transfer of personal data by a foreign recipient to an external third party, binding legal instruments must prohibit these transfers unless the transferring entity gives prior written authorisation, the recipient assumes full liability, commercial self-use is barred and equivalent safeguards and audit rights extend to all subsequent recipients.[10]
The annexes to the Note include the critical infrastructure Gazette Notice, because cross-borders transfers involving systems or information connected to critical infrastructure may raise security and national interest concerns. Additionally, there are BCR application forms, standard clauses for transfers between data controllers and between controllers and processors, and various annexes pertaining details that are to be included in the clauses and forms.[11]
Footnotes
- ODPC, Guidance Notes for Cross-Border Data Transfers, 2026, 10. ↩
- ODPC, Guidance Notes for Cross-Border Data Transfers, 2026, 11. ↩
- ODPC, Guidance Notes for Cross-Border Data Transfers, 2026, 10. ↩
- ODPC, Guidance Notes for Cross-Border Data Transfers, 2026, 49. ↩
- ODPC, Guidance Notes for Cross-Border Data Transfers, 2026, 20. ↩
- ODPC, Guidance Notes for Cross-Border Data Transfers, 2026, 10. ↩
- Section 50, Data Protection Act, Kenya (2019). ↩
- ODPC, Guidance Notes for Cross-Border Data Transfers, 2026, 26. ↩
- ODPC, Guidance Notes for Cross-Border Data Transfers, 2026, 24. ↩
- ODPC, Guidance Notes for Cross-Border Data Transfers, 2026, 21. ↩
- ODPC, Guidance Notes for Cross-Border Data Transfers, 2026, 28–63. ↩
Swahili 
English