The compliance layer of outsourcing to Kenya

Compliance is the part of the Kenya outsourcing decision buyers most often underestimate. It breaks into five areas: lawfully transferring personal data, managing Permanent Establishment tax risk, applying Kenyan employment law, operating statutory payroll, and protecting IP and confidentiality.

Four of those five are properties of Kenya and read the same whether you are buying from London, Frankfurt, Toronto or Chicago. Only the first varies, and it varies a great deal: a UK buyer needs the IDTA, an EU buyer Standard Contractual Clauses, a US buyer contract terms measured against state law, and Canadian, Australian and New Zealand buyers an accountability assessment. This page sets out the Kenyan obligations once and then splits the data-transfer question by market. None of it is prohibitive - Kenya’s Common Law foundations and GDPR-aligned data regime make the country easier to deal with than many alternatives - but each item is specific, current and must be in place before delivery starts. For the high-level summary, our compliance overview is the companion read, and the country guides carry the market-by-market working.

How do you transfer personal data to Kenya lawfully?

Answer: The Kenyan half of the answer is the same for everyone - the Data Protection Act 2019, enforced by the ODPC. The instrument you need at your own end depends on which country you are transferring from.

This is the first gate, and it applies before any work involving personal data begins. Take the constant first. Kenya’s Data Protection Act 2019 sets GDPR-aligned principles, requires breach notification within 72 hours, carries penalties of up to KES 5 million or 1% of annual turnover, and is overseen by the Office of the Data Protection Commissioner (ODPC). Because it is modelled on the GDPR, it gives a data-protection officer in almost any Western market a credible legal counterpart to point to - which makes the paperwork more tractable without removing it. The Kenyan regime is set out in full in our Data Protection Act guide.

What varies is the instrument your own regulator expects. Kenya holds no adequacy decision from either the UK or the EU, so European transfers need an explicit safeguard; the accountability-based regimes reach the same end by a different route.

One point buyers in every market miss: remote access by a Kenya-based team to personal data held at home is itself a transfer, even where the data never leaves your own servers. The mechanism applies to remote-working teams, not only to data physically exported.

How does a UK firm transfer data to Kenya lawfully?

Because the UK has not granted Kenya an adequacy decision, the lawful route is the UK International Data Transfer Agreement (IDTA), supported by a documented Transfer Risk Assessment that has been mandatory for new restricted transfers since 21 March 2024. Kenya’s GDPR-aligned regime supports that assessment but does not remove the IDTA requirement. Our UK GDPR and Kenya guide walks through the documentation, and the United Kingdom country guide puts it in the context of a UK buying decision.

How does an EU firm transfer data to Kenya lawfully?

Kenya holds no EU adequacy decision either, so transfers from Ireland, Germany, France or the Netherlands rest on the EU Standard Contractual Clauses, backed by a transfer risk assessment documenting the safeguards in place. The close modelling of Kenya’s Act on the GDPR is what makes that assessment more straightforward here than for many destinations. See the Ireland, Germany, France and Netherlands guides.

How does a US firm transfer data to Kenya lawfully?

The US position is structurally different. There is no comprehensive federal privacy statute and no national adequacy mechanism, so a US-to-Kenya transfer is governed by contract between the parties rather than by a prescribed instrument. What constrains it is the patchwork of state privacy law - California’s CCPA/CPRA, Virginia, Colorado, Connecticut, Utah and Texas among those with comprehensive statutes - and sector rules that travel with the data: HIPAA obligations follow protected health information, so a business associate arrangement is required for any team that touches it. The absence of a transfer gate is not an absence of obligation, and the export side remains regulated by Kenya’s Act. Our guide to US state privacy laws and Kenya sets out the detail, and the United States country guide frames it for a US buyer.

Canada, Australia and New Zealand: accountability regimes

These three operate accountability-based rules rather than transfer instruments. Canada’s federal PIPEDA makes the transferring organisation responsible for personal information it sends abroad, with Quebec’s Law 25 adding a mandatory assessment before personal information leaves the province. Australia’s Privacy Act 1988 and Australian Privacy Principle 8 keep the disclosing organisation accountable for what an overseas recipient does. New Zealand’s Privacy Act 2020, through Information Privacy Principle 12, permits disclosure only where the recipient is subject to comparable safeguards. In all three the obligation stays at home: outsourcing the processing does not outsource the accountability. See the Canada, Australia and New Zealand guides.

What is Permanent Establishment risk?

Answer: Activity in Kenya can create a taxable presence under whichever double taxation agreement covers your country; an EOR mitigates this but does not eliminate it.

Permanent Establishment (PE) is a taxable presence created in a foreign country by the nature of a company’s activities there. For any firm with people working in Kenya, the question is whether those activities cross the thresholds in the double taxation agreement between Kenya and the buyer’s own country - tests turning on control, contracting authority and fixed place of business. For a UK company that instrument is the UK-Kenya Double Taxation Agreement; other markets are governed by their own treaty, and treaty coverage is not universal, so the first question is which agreement applies to you at all. If the thresholds are crossed, profits can become taxable in Kenya. The most common mitigation is an Employer of Record, which becomes the legal employer of the Kenyan staff, but an EOR reduces rather than removes PE risk, and the outcome is fact-specific. Treaty-specific tax advice is essential before you commit. Our guide on Permanent Establishment risk in Kenya covers the structures in detail.

How familiar is Kenyan employment law?

Answer: Kenya’s Common Law system, derived from English law, governs employment through the Employment Act 2007 - familiar in structure to UK firms.

Kenya inherited Common Law from England, so the underlying logic of contracts, precedent and dispute resolution is recognisable to businesses in every Common Law market - the UK and Ireland, and equally the United States, Canada, Australia and New Zealand. Buyers from the civil-law traditions of Germany, France and the Netherlands will find the framing less familiar, though the practical effect on a services contract is usually small. The operative statute is the Employment Act 2007, which sets minimum terms on written contracts, working time, leave, notice and termination. Familiarity does not mean identity - local thresholds, notice periods and procedures differ from every one of these markets and must be followed precisely - but for Common Law buyers the conceptual distance is small. The detail sits in our Employment Act 2007 guide. Using an Employer of Record places this responsibility with a local entity that operates the Act day to day.

What statutory payroll obligations apply?

Answer: Employers operate PAYE, NSSF, SHIF and the Affordable Housing Levy, all remitted by the 9th of the following month.

Four statutory items apply to Kenyan staff, current to 2025/26:

• PAYE - progressive income tax across bands of 10%, 25%, 30%, 32.5% and 35%, withheld from salary, less personal relief of KES 2,400 a month. PAYE is filed and paid via the KRA iTax system. See our PAYE compliance guide.
• NSSF - pension at 6% employer and 6% employee, with an employer cap of KES 4,320 a month from February 2025. The employer obligations are covered in our NSSF guide.
• SHIF - the Social Health Insurance Fund levy at 2.75% of gross, administered by the Social Health Authority, which replaced NHIF in October 2024.
• Affordable Housing Levy - 1.5% employer plus 1.5% employee of gross pay. A NITA training levy also applies.

All are remitted by the 9th of the following month. PAYE is borne by the employee; the employer’s direct on-costs are NSSF, SHIF, the employer side of the Housing Levy and the NITA levy, which together run about 10-15% of gross pay.

A worked example: the employer on-cost on one role

Answer: On a KES 100,000 gross salary, the employer’s direct statutory on-cost is roughly KES 10,000-15,000 a month - about 10-15% - well below the employer burden in every market this site covers.

To make the on-cost concrete, take a supervisor on KES 100,000 gross per month. PAYE is withheld from that figure and borne by the employee, so it does not add to the employer’s cost. The employer’s own contributions stack up as follows.

That places the employer’s statutory on-cost at roughly 10-15% of gross. The comparison that makes it meaningful is with the buyer’s own market, and the gap differs by country: UK employer National Insurance alone is 15% from 6 April 2025 on top of pension auto-enrolment; German employer statutory contributions run around 21%; France is higher again; and in the United States the dominant cost is not statutory at all but employer-funded health insurance, which the KFF 2025 survey puts at an average single premium of USD 9,325, of which the employer pays about USD 7,885, on top of FICA at 7.65%. It is the combination of low salaries and modest on-costs that keeps fully loaded Kenyan delivery below all of these even with full statutory compliance. The role-level numbers sit on our costs overview and the why Kenya pillar; each country guide builds the comparison against its own market.

How are IP and confidentiality protected?

Answer: IP and confidentiality are secured through contract - assignment and confidentiality clauses - reinforced by Kenya’s Common Law framework and the Data Protection Act for personal data.

For most buyers, protecting intellectual property and confidential information is as important as data-transfer compliance, and unlike the transfer instrument this part does not change by market. The primary mechanism is contractual: clear IP-assignment and confidentiality clauses in the master service agreement and in individual employment contracts, ensuring that work product and inventions vest in the client. Kenya’s Common Law system makes these structures familiar and enforceable in ways buyers from any Common Law market recognise. Where an Employer of Record is used, confirm that IP created by the staff is assigned through the EOR to the end client, since the EOR is the legal employer. For personal data specifically, the Data Protection Act 2019 adds a statutory layer on top of the contract. This is a standard item to settle during due diligence rather than a novel risk.

How does compliance fit the wider decision?

Answer: Compliance is the condition for capturing Kenya’s other advantages, not a reason to avoid them - and an EOR carries most of the load.

The point of mapping these obligations is to show that they are bounded and well understood. The data regime is GDPR-aligned, the legal system is Common Law, and the payroll items are published and stable. An Employer of Record handles employment law, payroll and much of the PE mitigation, leaving the buyer to manage data-transfer documentation with counsel - the one piece that genuinely depends on where you are. Set against the cost, time-zone and workforce advantages, compliance is the manageable cost of entry rather than a barrier. The full structural case is on our why Kenya pillar.

Key terms

Adequacy decision

A UK government finding that another country's data protection is equivalent to UK GDPR; Kenya does not have one, which is why the IDTA is required.

IDTA

The UK International Data Transfer Agreement, the contractual route that lawfully covers personal-data transfers to a non-adequate country, paired with a Transfer Risk Assessment.

Permanent Establishment

A taxable presence created in a foreign country by the nature of a company's activities there, assessed under the relevant double taxation treaty.

PAYE

Pay As You Earn - Kenya's withholding income tax on salaries, filed and paid through the KRA iTax system.

SHIF

The Social Health Insurance Fund levy at 2.75% of gross pay, which replaced NHIF in October 2024.

Further Reading

• Compliance Overview - the obligations summarised
• IDTA for Kenya - the data-transfer agreement in practice
• UK GDPR and Kenya - the data documentation in full
• Standard Contractual Clauses for Kenya - the EU transfer route
• US state privacy laws and Kenya - the US position
• Country guides - the transfer instrument and payroll comparison for your market
• Kenya Data Protection Act - the local regime and the ODPC
• PAYE and Statutory Compliance - employer payroll obligations
• NSSF Employer Obligations - the pension contribution rules
• Permanent Establishment Risk in Kenya - managing tax presence
• Kenya Employment Act 2007 - the governing employment statute