In recent years, Kenya has seen a significant shift in how data protection is regulated, with the implementation of the Data Protection Act, 2019. This groundbreaking legislation aims to safeguard individuals’ personal data while promoting transparency and accountability in data processing practices. In this article, we delve into the key provisions of the Data Protection Act and explore what it means for businesses and individuals in Kenya. From understanding data subjects’ rights to compliance requirements for data controllers and processors, we provide actionable insights to help navigate the evolving landscape of data protection law in Kenya.