Data Protection for Lenders in Kenya (2026): ODPC Registration, Consent and CBK Rules
Lending runs on personal data: ID numbers, phone numbers, M-Pesa histories, employers, guarantors and credit reports. In Kenya that makes every lender a data controller under the Data Protection Act, 2019. Since 29 September 2026, credit-only lenders also have to meet CBK's own data rules in the Non-Deposit Taking Credit Providers Regulations (Legal Notice 191). Those rules include a strict requirement for separate, express consent that a privacy notice no longer satisfies.
This guide covers what Kenyan lenders must do about data protection: registration, consent, confidentiality, security, credit bureau sharing and AI decisions.
A practical summary, not legal advice. Check your specific setup with the Office of the Data Protection Commissioner (ODPC) or your advocate.
1. Register with the Data Protection Commissioner, whatever your size
The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 exempt small organisations from registration: those with turnover or revenue under KES 5 million and fewer than ten employees. But the exemption doesn't apply to anyone processing data for a purpose in the Third Schedule, and "provision of financial services" is on that list. So a lender has to register, however small it is.
| Category | Size | Registration (once) | Renewal (every 2 years) |
|---|---|---|---|
| Micro and small | 1–50 employees, turnover up to KES 5 million | KES 4,000 | KES 2,000 |
| Medium | 51–99 employees, turnover KES 5–50 million | KES 16,000 | KES 9,000 |
| Large | Over 99 employees, turnover over KES 50 million | KES 40,000 | KES 25,000 |
Fees are as set in the regulations published on Kenya Law. Confirm current fees on the ODPC website. An entity that is both a data controller and a data processor registers for each role separately.
2. Consent: a privacy notice is no longer enough
Regulation 58 of Legal Notice 191 sets a demanding consent standard. When a lender processes a customer's personal data, consent must be:
- express, freely given, specific and unambiguous,
- obtained separately, through a consent form that is not part of the loan offer letter or the terms and conditions,
- capable of being withdrawn,
- verifiable, and kept as part of the customer's record.
The consent form must at least tell the customer:
- what types of personal data you'll process,
- who may access it,
- how long you'll keep it.
The regulation says plainly that a privacy notice or similar general notice does not count as express consent. If your app or onboarding form relies on a "by continuing you agree to our privacy policy" line, it needs to change.
3. Confidentiality and sharing
Under regulation 32:
- You need policies, procedures and systems that keep customer information and transactions confidential.
- You can share customer information only with the customer's express consent, or where a written law requires or permits it.
- Directors, staff and third-party service providers must protect confidentiality, and staff remain bound after they leave.
The collection rules reinforce this. Accessing a borrower's phone contacts, or messaging them to shame the borrower, is banned outright. See debt collection rules for lenders in Kenya.
4. Credit bureau data
Lenders must share credit information with licensed credit reference bureaus, and must comply with the Data Protection Act when doing so. Bureau reports may only be used for credit and employment decisions, or other purposes the law allows, and must be kept secure. The 30-day pre-listing notice and the KES 1,000 minimum are covered in CRB reporting for lenders in Kenya.
5. Security: what your systems must do
Regulation 36 requires secure, reliable IT systems that protect the confidentiality, integrity and availability of information. Where applicable, you also need an IT policy covering at least:
- data encryption standards,
- information security guidelines,
- application security,
- network access,
- password security for web and mobile apps,
- audit log management,
- application monitoring,
- software change control,
- backups,
- disaster recovery,
- interoperability.
You must notify CBK when you change your IT system. Regulation 61 adds cybersecurity duties:
- infrastructure to monitor, detect, prevent and respond to threats,
- trained staff,
- authentication controls protecting customer data, transactions and systems.
6. AI and automated lending decisions
If you use AI to make lending decisions, regulation 60 requires you to:
- explain automated decisions to customers whose applications they affect,
- tell customers when they're dealing with AI rather than a person,
- keep human oversight and review,
- assess and reduce discriminatory bias,
- use models that are robust and accurate,
- keep algorithms transparent and explainable,
- manage privacy and security.
Rule-based scoring with clear thresholds is much easier to explain than a black-box model.
7. Your software vendor handles your borrowers' data too
When you use a loan management system, your vendor processes your borrowers' data on your behalf. Before you sign:
- Put a written data processing agreement in place.
- Ask where data is hosted, and whether your data is kept separate from other clients'.
- Check who at the vendor can access it, and how access is logged.
- Confirm what happens to your data if you leave.
Vendors that are material service providers may also fall under CBK's outsourcing rules, including notifying CBK 30 days in advance.
Data protection checklist for lenders
- Register with the ODPC as a data controller.
- Replace "agree to our privacy policy" with a separate consent form covering data types, access and retention, and record each borrower's consent.
- Let borrowers withdraw consent, and act on it.
- Write down who can access customer data, and restrict access by role.
- Never access borrowers' phone contacts, and never share data without consent or a legal basis.
- Get a data processing agreement from every vendor that touches borrower data.
- Adopt an IT and security policy covering encryption, passwords, audit logs, backups and disaster recovery.
- Make automated credit decisions explainable, and keep a human in the loop.
- Set retention periods, and delete data you no longer need.
- Train staff, and remind leavers of their ongoing confidentiality duty.
How Lendpoint protects borrower data
- Each lender's data is held in its own isolated database schema.
- Staff access is controlled by role, with branch restrictions available.
- Sign-in can be protected with one-time passcodes.
- Every loan action is written to an audit log, and databases are backed up automatically.
- Eligibility uses clear credit scores and loan limits that staff can explain.
- Lendpoint doesn't access borrowers' phone contacts.
See Lendpoint for Kenyan lenders.
Frequently asked questions
Do lenders in Kenya need to register with the ODPC?
Yes. The usual small-business exemption doesn't apply to processing personal data for financial services, so lenders must register as data controllers with the Office of the Data Protection Commissioner whatever their size.
How much does ODPC registration cost?
Under the registration regulations published on Kenya Law: KES 4,000 for micro and small entities (KES 2,000 renewal every two years), KES 16,000 for medium (KES 9,000 renewal) and KES 40,000 for large (KES 25,000 renewal). Check the ODPC for current fees.
Is a privacy policy enough consent for a loan app in Kenya?
No. CBK's 2026 regulations require express, specific consent through a separate consent form that isn't part of the loan terms, can be withdrawn, and is recorded. A privacy notice doesn't satisfy this.
Can a lender share my personal data with others?
Only with your express consent or where a written law requires or permits it, such as sharing credit information with licensed credit reference bureaus.
Can loan apps access my phone contacts?
Lenders may not access a borrower's phone book or contacts to message them about late or missed payments, and may not contact a borrower's contacts without authorisation.
What must lenders do when using AI to approve loans?
Explain automated decisions to affected customers, tell them when they're dealing with AI, keep human oversight, check for discriminatory bias, and keep models accurate, transparent and secure.
