Microsoft 365 can support your obligations under Kenya’s Data Protection Act 2019, but only if you switch the right settings on. The controls that matter most are multifactor sign-in and conditional access, device encryption, sensitivity labels and data loss prevention, retention, audit logs and threat detection, and most of them come with Microsoft 365 Business Premium or the E3 and E5 plans. Software alone does not make you compliant: you also need policies, processes and, where required, registration with the Office of the Data Protection Commissioner.
This is not legal advice. It explains which Microsoft 365 controls help with the technical side of data protection. Whether your organisation complies depends on what personal data you hold, why you hold it, and the policies, contracts, consent and staff habits around it. Speak to a qualified advisor about your legal obligations; speak to us about the technology.
What the Act asks of your systems
The Act asks every data controller and data processor to protect personal data with appropriate technical and organisational measures. We read the Kenya Law edition of the Data Protection Act (Cap. 411C), originally enacted as the Data Protection Act, 2019 (No. 24 of 2019), and the Office of the Data Protection Commissioner’s data protection laws page (both checked 4 October 2026). The sections most relevant to your Microsoft 365 setup are these:
- Section 25, principles. Eight principles, from processing in line with the data subject’s right to privacy and processing lawfully, fairly and transparently, to collecting only what is necessary, keeping it accurate, keeping it in identifiable form no longer than necessary, and not transferring it outside Kenya without proof of adequate safeguards or consent. The full list is in the questions at the end of this article.
- Section 39, retention. Keep personal data only as long as reasonably necessary for its purpose, unless the law or another listed reason requires longer, then delete, erase, anonymise or pseudonymise it.
- Section 41, data protection by design or by default. Among the measures to consider, the Act names identifying foreseeable risks, safeguards against them, pseudonymisation and encryption, the ability to restore access to personal data in a timely manner after an incident, and checking that safeguards work and stay up to date.
- Section 43, breach notification. Where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm, the data controller must notify the Data Commissioner without delay, within 72 hours of becoming aware of the breach, and tell affected people in writing within a reasonably practical period. A data processor must tell the controller without delay and, where reasonably practicable, within 48 hours.
- Sections 48 and 49, transfers out of Kenya. Transfers need proof of appropriate safeguards or another listed condition, and sensitive personal data needs the data subject’s consent and confirmation of safeguards.
The ODPC’s breach reporting form refers to Section 43 and asks whether the breach was reported after 72 hours of discovery (checked 4 October 2026). In practice that means you need to find out quickly that something has gone wrong, and know what was affected. That is where Microsoft 365’s logs and alerts earn their keep.
ODPC registration
Section 18 says no person shall act as a data controller or processor unless registered with the Data Commissioner, subject to thresholds the Commissioner sets. The ODPC’s FAQs (checked 4 October 2026) say that organisations with an annual turnover below KES 5 million and fewer than 10 employees are exempt, but only if they meet both conditions, and that certain sectors, including education, health, financial services, insurance and transport, must register regardless. The FAQs also state that a certificate of registration is valid for 24 months. Registration is done online through the ODPC’s data portal. Microsoft 365 settings do not replace this step.
The regulations under the Act
The Act is not the whole picture. The ODPC’s data protection laws page (checked 4 October 2026) also lists the Data Protection (General) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, the Data Protection (Complaints Handling and Enforcement) Regulations, 2021 and the Data Protection (Civil Registration) Regulations, 2020, each as a PDF. Your advisor will tell you which apply to you; the technical controls below support all of them.
Microsoft 365 controls mapped to the Act
Each obligation above has one or more Microsoft 365 controls that help, and the plan you hold decides which of them you have. Business Basic and Business Standard cover the basics. Microsoft 365 Business Premium adds most of the controls in this table for organisations of up to 300 users, and E3 and E5 cover larger organisations.
| What the Act expects | Microsoft 365 control | Plans that include it |
|---|---|---|
| Safeguards against foreseeable risks (s.41) | Multifactor sign-in for every user | All business and enterprise plans, through core identity with Microsoft Entra ID |
| Access limited to the right people (s.25, s.41) | Conditional access: block risky sign-ins, require compliant devices | Business Premium; E3, F1 and F3 (Entra ID Plan 1); E5 (Entra ID Plan 2) |
| Encryption (s.41) | Device encryption and policies through Microsoft Intune | Business Premium, E3, F1 and F3 (Intune Plan 1); E5 adds Intune Suite capabilities |
| Encryption and data minimisation (s.41) | Sensitivity labels with Microsoft Purview Information Protection | Business Premium, E3, F1 and F3 (Plan 1); E5 (Plan 2) |
| Stop personal data leaking (s.41) | Data loss prevention for email and files | Business Premium; E5 adds Insider Risk Management and Communication Compliance |
| Retention limits (s.39) | Mailbox archive, retention settings and eDiscovery | Archive in every plan with email (50 GB on Basic and Standard, 1.5 TB on Premium, E3 and E5); eDiscovery Standard in E3, Premium in E5 |
| Show what happened (s.41, s.43) | Microsoft Purview Audit | Audit Standard in Business Premium, E3, F1 and F3; Audit Premium in E5 |
| Detect breaches fast (s.43) | Microsoft Defender alerts for email, devices and identities | Business Premium (Defender for Business, Defender for Office 365 Plan 1); E3 (Defender for Endpoint Plan 1, Defender for Office 365 Plan 1); E5 (Plan 2 versions, Defender for Identity, Defender for Cloud Apps) |
| Restore access after an incident (s.41) | Independent backup of Exchange, OneDrive, SharePoint and Teams | Not part of Microsoft 365 plans; we provide it with Veeam |
Business Basic and Business Standard include automatic spam and malware filtering and time-of-click protection for links, but not device management, conditional access or data loss prevention. If you hold patient records, member savings, payroll or client files on those plans, that gap is worth a conversation. Plan prices are on our Microsoft 365 pricing page.
What each control does in plain terms
Multifactor sign-in and conditional access stop most account takeovers, which is the most common way business email in Kenya gets compromised: a phished password, then fake invoices sent to your clients. Conditional access adds rules such as “finance staff can only open payroll files from company laptops”.
Encryption protects data if a laptop is left in a taxi or a phone is stolen in town. Intune enforces disk encryption and a PIN, and lets you wipe company data from a lost device. The Act also notes that you may not need to tell affected people about a breach where appropriate safeguards, which may include encryption of the affected data, were in place. That is a strong reason to encrypt laptops before anything goes missing.
Sensitivity labels and data loss prevention let you mark documents such as “Confidential – client data” and block them from being emailed outside the organisation, or warn the sender first. A clinic can stop patient lists going to personal Gmail addresses; a law firm can stop client files being shared by anonymous link.
Retention settings keep what you must keep and remove what you should not keep forever. Decide your retention periods with your advisor first, then set them in Microsoft 365. Retention is about deleting on schedule as much as about keeping.
Audit logs answer “who opened, shared or deleted this, and when?”. Without them, a breach report to the Commissioner becomes guesswork.
Threat detection through Microsoft Defender raises alerts for malicious links, compromised accounts and infected devices, so your clock for the 72-hour notification starts with facts rather than rumours.
Backup matters because the Act names the ability to restore access to personal data after an incident. Microsoft keeps its service running, but restoring your own deleted or encrypted data after ransomware or a mistaken deletion is your responsibility. Our Microsoft 365 backup service uses Veeam to keep an independent copy.
Next step: tell us your plan and the personal data you hold, and we will show you which of these settings are already available to you and which are switched off.
No obligation. Our team in Karen, Nairobi answers you directly.
How to switch on the Microsoft 365 settings that support the Data Protection Act
- Map your personal data. List what personal data you hold (staff, clients, patients, members, students), where it lives in Microsoft 365 and who needs it. This is also the information the ODPC asks for when you register.
- Check your licences. Confirm which plan each user holds, because conditional access, Intune, labels, data loss prevention and audit depend on it. Move the people who handle sensitive data to Business Premium or E3 if they need these controls.
- Turn on multifactor sign-in for everyone. Include admins first, then all staff, and help each person set up the Microsoft Authenticator app. Keep separate admin accounts for the two or three people who need them.
- Add conditional access policies. Block sign-ins from legacy email apps that bypass multifactor sign-in, and require compliant devices for access to sensitive data.
- Enrol and encrypt devices. Enrol company laptops in Intune with disk encryption, updates and Defender switched on, and apply app protection to personal phones so company data can be wiped without touching personal photos.
- Publish sensitivity labels. Start with three or four labels, such as Public, Internal, Confidential and Highly confidential, and apply encryption to the top ones.
- Create data loss prevention policies. Start in test mode for common Kenyan identifiers in your data, such as ID numbers, KRA PINs and phone numbers, review what would have been blocked, then enforce.
- Set retention. Apply the retention periods your policy defines to mailboxes, OneDrive, SharePoint and Teams, and make sure data is deleted when the period ends.
- Confirm audit logging. Check that auditing is on and that the people who investigate incidents can search the audit log.
- Route security alerts to a person. Send Defender alerts to a named mailbox or person who checks it daily, and write down who decides whether an incident must be reported to the Data Commissioner.
- Back up and test a restore. Back up Exchange, OneDrive, SharePoint and Teams independently, and test restoring a mailbox and a folder before you need to.
- Review every quarter. Check Microsoft Secure Score, the users with admin rights, external sharing links and leavers’ accounts, and record what you changed.
What Microsoft 365 cannot do for you
Compliance needs policies and processes as well as settings. Microsoft 365 cannot decide your lawful basis for processing, write your privacy notice, collect consent, sign data processing agreements with your suppliers, carry out a data protection impact assessment where Section 31 requires one, or answer a data subject’s request on time. It cannot train the staff member who forwards a client list to a personal address, or decide, under pressure, whether an incident has a real risk of harm.
What it can do is make good policies enforceable and give you evidence when you need it. A written policy that says “no client data on personal email” is far stronger when data loss prevention actually blocks it and the audit log shows it worked.
How we help
We work through the technical side with you, step by step, and stay with you after go-live. That means reviewing your licences so you are not paying for controls you never switch on, configuring the settings in the checklist above, setting up backup with Veeam, and training staff on safe email habits with Mimecast security awareness training. Our Microsoft 365 security page explains the full service. For the legal side, such as policies and registration decisions, we work alongside your own advisor rather than replacing them.
Data Protection Act and Microsoft 365 questions
Does using Microsoft 365 make us compliant with the Data Protection Act?
No, Microsoft 365 provides technical controls that support compliance, but you also need policies, processes and, where required, ODPC registration.
Controls such as multifactor sign-in, encryption, data loss prevention and audit logs help you meet the Act’s security expectations once they are switched on. Microsoft 365 security.
Which Microsoft 365 plan is best for Data Protection Act compliance?
For organisations of up to 300 users, Microsoft 365 Business Premium includes most of the relevant controls: conditional access, Intune, Defender, sensitivity labels, data loss prevention and audit.
Larger organisations look at E3 or E5. Only staff who handle sensitive data need the higher plan. Microsoft 365 Business Premium.
How quickly must a data breach be reported in Kenya?
Section 43 of the Data Protection Act requires a data controller to notify the Data Commissioner without delay, within 72 hours of becoming aware of a qualifying breach.
Late notifications must give reasons for the delay. Breaches are reported through the ODPC’s breach reporting page.
Do we need to register with the ODPC?
Most organisations do; the ODPC exempts only those with turnover below KES 5 million and fewer than 10 employees, and not in listed sectors such as education, health and financial services.
Check the details on the ODPC’s FAQs or with your advisor.
Can Microsoft 365 detect Kenyan ID numbers and KRA PINs in documents?
Data loss prevention policies can be set to look for patterns in your data, such as ID numbers, KRA PINs or phone numbers, and warn or block when they are shared.
We test policies before enforcing them so staff are not blocked by mistake. How we set up security. Restoring personal data after an incident is covered by backup, which Microsoft leaves to you.
What is the Data Protection Act in Kenya?
The Data Protection Act is the Kenyan law, enacted as Act No. 24 of 2019 and in force since 25 November 2019, that gives effect to the constitutional right to privacy in Article 31(c) and (d), set up the Office of the Data Protection Commissioner and regulates how personal data is processed.
It sets out the rights of data subjects and the obligations of data controllers and processors, including registration, security safeguards and breach notification (Kenya Law, checked 4 October 2026).
What is the latest version of the Kenya Data Protection Act?
The latest version on Kenya Law is the Data Protection Act, Cap. 411C, as revised on 31 December 2022, which Kenya Law marks as “the latest version of this Act” (checked 4 October 2026).
It is the 2019 Act (No. 24 of 2019) in the revised Laws of Kenya. Regulations made under it in 2020 and 2021 are listed separately on the ODPC’s laws page.
What are the 7 principles of the Data Protection Act?
Kenya’s Act has eight principles, not seven: section 25 says every data controller or processor must ensure personal data is:
- processed in accordance with the data subject’s right to privacy;
- processed lawfully, fairly and transparently;
- collected for explicit, specified and legitimate purposes, and not used in a way incompatible with them;
- adequate, relevant and limited to what is necessary;
- collected only with a valid explanation whenever information about family or private affairs is required;
- accurate and, where necessary, kept up to date, with inaccurate data erased or corrected without delay;
- kept in a form that identifies people for no longer than necessary; and
- not transferred outside Kenya unless there is proof of adequate safeguards or the data subject’s consent.
The “seven principles” often quoted online come from the UK and EU GDPR. Source: section 25 on Kenya Law, checked 4 October 2026.
Where can I get a PDF of the Kenya Data Protection Act?
Official PDFs are free from two sources: the ODPC’s copy of the Act as published in the Kenya Gazette Supplement, and the “Download PDF” link on the Kenya Law page for the Act, which holds the revised Cap. 411C version.
Both were checked on 4 October 2026. The ODPC also publishes the 2020 and 2021 regulations as PDFs on its laws page.