The Kenya Data Protection Act and Land Transactions: What Buyers and Firms Need to Know
Every Kenya property transaction generates personal data. Names, ID numbers, tax PINs, bank account details, source of funds documents, and physical addresses all pass through the hands of advocates, land agents, verification services, and the land registry itself.
The Kenya Data Protection Act 2019 (DPA) and the regulatory framework built under it determine how that data must be handled. Non-compliance is not merely a reputational issue. It attracts fines, enforcement orders, and the possibility of criminal liability.
This article explains what the DPA requires from firms operating in the property sector, and what rights you have as a data subject involved in a land transaction.
The Kenya Data Protection Act 2019: Core Framework
The DPA came into force in November 2019. It applies to any person or organisation that processes personal data about individuals in Kenya, or that processes data about Kenyan residents from outside Kenya.
"Processing" includes collecting, storing, sharing, analysing, and deleting personal data. A law firm that collects a client's National ID for CDD purposes is processing personal data. A land verification service that records a parcel owner's details from a registry file is processing personal data.
The DPA establishes eight data protection principles. The most relevant to property transactions are:
Lawfulness, fairness, and transparency. Data must be collected on a lawful basis and data subjects must be informed how their data will be used.
Purpose limitation. Data collected for one purpose cannot be used for another purpose without the data subject's knowledge.
Data minimisation. Only data that is necessary for the stated purpose should be collected.
Storage limitation. Data should not be retained longer than is necessary.
Security. Appropriate technical and organisational measures must protect personal data from unauthorised access, loss, or destruction.
ODPC Registration: Who Must Register and What It Costs
The Office of the Data Protection Commissioner (ODPC) is Kenya's data protection regulator. It administers the DPA, investigates complaints, and has the power to issue fines and enforcement orders.
Under ODPC regulations, data controllers and data processors who handle personal data at a certain scale are required to register with the ODPC. The registration fee is KES 4,000 for most organisations.
For firms operating in the property sector, this registration requirement applies broadly:
Law firms conducting CDD for AML/CFT purposes are processing client personal data and must be registered.
Land verification companies that collect registry data, personal identity information, or parcel-level data about individuals are processing personal data and must be registered.
Real estate agencies that maintain client databases with personal details must be registered.
Property developers collecting buyer information are processing personal data and must be registered.
Failure to register is an offence under the DPA. The ODPC has been active in enforcement since 2022 and has issued fines and enforcement notices to non-compliant organisations.
What a Land Verification Service Must Tell You
If you commission a land verification service, the firm is processing your personal data and data about third parties connected to the property (registered owners, previous owners, encumbrance holders).
Under the DPA's transparency principle, a compliant verification service must have a clear, accessible privacy policy that explains:
What personal data is collected about you and about third parties in connection with your order.
The legal basis for processing that data (typically, contractual necessity and legitimate interest).
How long the data is retained.
Whether data is shared with third parties, and with whom.
Your rights as a data subject.
A verification firm that operates without a privacy policy, or that has a generic policy not tailored to property verification activities, is operating without proper DPA compliance.
What Advocates Must Do With Client Data
Advocates processing client data for property conveyancing are both data controllers (in relation to their clients) and potentially data processors (if they use third-party systems to store client data).
Under the DPA and the LSK Guidelines, advocates must:
Provide clients with a privacy notice or data processing notice at the start of the engagement. This notice must explain what data is collected, why, how long it is kept, and who it is shared with.
Share personal data with third parties (such as the land registry, valuation firms, and verification services) only where lawful authority exists.
Retain client data securely for the period required by law (seven years under POCAMLA for AML records, and the equivalent period for conveyancing files under professional practice rules).
Respond to data subject access requests from clients who ask to see what personal data the firm holds about them.
Delete or anonymise data that is no longer needed once retention periods expire.
Your Rights as a Data Subject in a Property Transaction
The DPA gives every data subject a set of enforceable rights:
Right of access. You have the right to ask any firm holding your personal data to tell you what data they hold, how they are using it, and to provide you with a copy.
Right to rectification. If data held about you is incorrect, you have the right to request correction.
Right to erasure. In certain circumstances, you have the right to request that your data be deleted. This right is not absolute. Where a legal obligation requires retention (such as the seven-year AML record-keeping requirement), the firm can decline to delete.
Right to object. You can object to processing based on legitimate interests. If the objection is upheld, the processing must stop.
Right to complain. If you believe your data has been mishandled, you can file a complaint with the ODPC at odpc.go.ke. The ODPC can investigate, issue enforcement orders, and impose fines.
Data Protection in the Context of Ardhisasa and the Land Registry
Kenya's Ardhisasa platform holds title information, encumbrance records, and in some cases personal information about registered landowners. The National Land Information Management System (NLIMS) is the underlying data infrastructure.
The public-facing Ardhisasa search results are published under the Land Registration Act, which provides the legal basis for registry data being accessible to persons with a legitimate interest in a parcel.
However, personal data extracted from registry searches and used for secondary purposes (such as building marketing databases or profiling property owners) would require a separate legal basis under the DPA.
Verification firms that use registry data solely for the purpose of verifying title on behalf of a client with a legitimate interest in the parcel have a defensible legal basis. Firms that aggregate and repurpose that data for other commercial activities must consider whether they have appropriate consent or legitimate interest to do so.
Why Litmus Takes Data Protection Seriously
Litmus operates in a sector where clients share sensitive personal and financial information. Our verification process involves accessing registry records that include personal data about registered owners and encumbrance holders.
We are registered with the ODPC. We maintain a privacy policy that explains our data collection, retention, and sharing practices in plain language. We retain client data for the period required by law and no longer.
Our reports are produced for the specific client who commissions them, for the specific parcel identified in the order. We do not build secondary commercial databases from registry data.
A Litmus standard verification is KES 21,500. A field verification is KES 25,500. Both include a Section 106B certificate and a signed, dated report that documents what was found and how.
This article is for general information only and does not constitute legal advice. For data protection compliance advice specific to your firm or transaction, consult a qualified Kenya advocate or data protection specialist.
Buying, lending, or building on Kenyan land? Know exactly what you're dealing with — get a full intelligence report →
Verify a parcel →Related Articles
Can a Non-Kenyan Citizen Buy Land in Kenya? The Complete Guide
Kenya's Constitution restricts freehold land ownership to Kenyan citizens. Non-citizens can hold leasehold land. Here is what this means in practice for foreign nationals, diaspora dual-citizens, and corporate buyers.
Can a Non-Kenyan Citizen Buy Land in Kenya? The Restrictions Explained
Kenya's Constitution reserves freehold land for citizens only. Non-citizens and foreign nationals can still hold land, but only on leasehold terms. Here is how it works.
Certified Documents in Kenya Property Transactions: What Counts and What Doesn't
Not all copies of Kenya property documents are equal. 'Certified' has a specific legal meaning, and the certification authority matters. Here is what counts as a properly certified document and what is insufficient.