The compliance questions a UK buyer has to answer before sending work or personal data to Kenya, and how each is satisfied in practice.
What this report covers
Cross-border data transfers; permanent establishment risk; the Employment Act 2007; statutory payroll for 2025/26; the legal system; and delivery models with a compliance checklist.
Headline findings
- Kenya has no UK adequacy decision, so transfers need a safeguard. In practice that is the International Data Transfer Agreement, or the UK Addendum to the EU SCCs, in both cases supported by a Transfer Risk Assessment. The ICO regulates.
- Kenya’s own regime is GDPR-aligned. The Data Protection Act 2019 is enforced by the Office of the Data Protection Commissioner, which requires registration of both data controllers and processors and sets conditions on onward transfer. This supports a Transfer Risk Assessment; it does not replace the UK exporter’s duty.
- Statutory employer on-costs are low by Western standards — SHIF at 2.75% of gross, the Affordable Housing Levy at 1.5% matched by the employer, and NSSF capped — which is a large part of why fully-loaded cost diverges from gross salary less sharply than buyers expect.
- Kenya operates a Common Law system derived from English law, so contract concepts, drafting conventions and dispute-resolution mechanisms are familiar to UK counsel.
Method and limitations
This report states the mechanisms and the instruments that satisfy them; it is not legal advice and does not substitute for your own Transfer Risk Assessment. Statutory rates change: SHIF replaced NHIF in late 2024 and the housing levy is recent, so confirm current rates before contracting.
Requirements branch by buyer market, and this guide is written for the UK. EU buyers need SCCs plus a transfer impact assessment; US buyers contract against state law with HIPAA following health data; Canadian buyers face PIPEDA and Québec Law 25; Australia applies APP 8 and New Zealand IPP 12. See the country guides for those.
Inside the full report
The transfer-mechanism detail for the UK and a table covering the other eight buyer markets, permanent-establishment risk, the Employment Act 2007 and the 2024 changes to statutory payroll. Request it below.