# What does Kenya's Data Protection Act require of clinics?

URL: https://tymirahealth.com/resources/faqs/what-does-kenyas-data-protection-act-require-of-clinics
For: Executives | Data protection and privacy | Last reviewed 16 October 2026

**Answer:** Kenya's Data Protection Act 2019 treats health data as sensitive personal data. Clinics must register with the Office of the Data Protection Commissioner (ODPC), whatever their size, and need a lawful basis for each use of health data, a clear consent process, role-based access, audit trails, controls on data leaving Kenya and a plan to report serious breaches to the ODPC within 72 hours. This is general information, not legal advice.

### A short compliance checklist

Compliance is a habit, not a certificate. Software can enforce access and logging, but policies, training and regular review keep a clinic compliant.

- Register with the ODPC, name a data protection lead and complete a Data Protection Impact Assessment for your records system.
- Give patients a clear privacy notice and handle access, correction and deletion requests.
- Give each staff member their own login, limited to their role, and review audit logs.
- Sign a data processing agreement with every vendor that handles patient data, stating where it is hosted.
- Keep a one-page breach plan. Penalties can reach KES 5 million or 1% of annual turnover, whichever is lower.

Confirm your obligations with a qualified advocate or the ODPC.

Read the full guide: [Healthcare Compliance, Security and Reporting Guide for Clinics](https://tymirahealth.com/resources/blog/healthcare-compliance-security-reporting-guide)

## Related questions

- [Can clinics in Kenya store patient data on cloud servers outside Kenya?](https://tymirahealth.com/resources/faqs/can-clinics-store-patient-data-outside-kenya)
- [Can employers screen staff for mental health conditions?](https://tymirahealth.com/resources/faqs/can-employers-screen-staff-for-mental-health-conditions)
- [Does a clinic need to register with the ODPC?](https://tymirahealth.com/resources/faqs/does-a-clinic-need-to-register-with-the-odpc)

---

**About Tymira Health:** Tymira Health is a healthcare technology company based in Nairobi, Kenya. It builds Tymira360, a practice management and EHR platform for mental health, physiotherapy and dental providers, clinics, hospitals, NGOs and insurers across Africa.

- Book a demo: https://tymirahealth.com/demo
- Contact: https://tymirahealth.com/contact (info@tymirahealth.com)
- All resources: https://tymirahealth.com/resources/all