# What do clinics in Kenya need to comply with the Data Protection Act when using an EHR?

URL: https://tymirahealth.com/resources/faqs/what-do-clinics-in-kenya-need-to-comply-with-the-data-protection-act-when-using-an-ehr
For: Clinicians | Mental health providers | Reviewed by Independent clinical reviewer, Registered mental health clinician, Kenya | Last reviewed 23 October 2026

**Answer:** Clinics in Kenya process health data, which is sensitive personal data under the Data Protection Act 2019. They need to register with the Office of the Data Protection Commissioner, hold the data handler or processor certificate now required for KMPDC facility registration, have a lawful basis and consent processes, limit access to what each role needs, secure records and manage any transfer of data outside Kenya.

### Key obligations for clinics

**Compliance checklist (for legal and privacy review)**

- Register with the ODPC as a data controller and/or processor.
- Hold the ODPC certificate required for KMPDC facility registration.
- Document the lawful basis and consent for processing health data.
- Collect only the data you need (data minimisation).
- Control and log access to records by role.
- Assess and document any transfer of data outside Kenya.
- Train staff and keep a privacy policy and breach plan.

An EHR does not make a clinic compliant by itself, but the right system makes access control, consent records, audit trails and patient requests much easier to manage.

> **Important:** This Knowledge Hub article is operational and product-neutral education. It does not provide clinical, legal or regulatory advice. Local clinical governance, privacy and compliance review should guide live clinic decisions.

## More questions

### Is health data sensitive personal data in Kenya?

Yes. The Data Protection Act 2019 classifies health data as sensitive personal data with stricter rules.

### What are the penalties for non-compliance?

Reported penalties include fines of up to KES 5 million or 1% of annual turnover, plus registration consequences with KMPDC.

### Can patient data be stored outside Kenya?

Only under the conditions for cross-border transfer in the Act and its regulations. Review hosting arrangements with counsel.

## Related questions

- [How can mental health clinics in Kenya accept M-Pesa and match payments to sessions?](https://tymirahealth.com/resources/faqs/how-can-mental-health-clinics-in-kenya-accept-m-pesa-and-match-payments-to-sessions)
- [How can mental health clinics in Kenya prepare for SHA claims?](https://tymirahealth.com/resources/faqs/how-can-mental-health-clinics-in-kenya-prepare-for-sha-claims)
- [How do I choose therapy notes software?](https://tymirahealth.com/resources/faqs/how-do-i-choose-therapy-notes-software)

---

**About Tymira Health:** Tymira Health is a healthcare technology company based in Nairobi, Kenya. It builds Tymira360, a practice management and EHR platform for mental health, physiotherapy and dental providers, clinics, hospitals, NGOs and insurers across Africa.

- Book a demo: https://tymirahealth.com/demo
- Contact: https://tymirahealth.com/contact (info@tymirahealth.com)
- All resources: https://tymirahealth.com/resources/all