Data protection training for staff in Kenya
Every organisation that handles personal data in Kenya must protect it under the Data Protection Act 2019, and staff are where most breaches start. This course covers what employees must do day to day, in an edition for your sector, and ends with a certificate of completion issued by FNJ.
Choose how your team takes the course
On demand suits people joining through the year and annual refreshers. Live sessions use your own policies, products and cases.
KES 8,000per learner
- Start as soon as payment is confirmed
- Certificate of completion
- Completion report for your records
KES 5,000per learner per hour, minimum KES 8,000 per learner
- From 1 hour; you choose the length
- On Zoom or Teams
- Tailored to your operations
KES 5,000per learner per hour, minimum 5-hour session
- At your premises
- Combine with other courses to fill the session
- Case exercises in groups
From the 5th hour, each extra hour is half price. Live and in-person prices are calculated on a minimum of 5 learners; smaller groups are welcome and are priced as 5. For more than 75 learners or more than 16 hours we prepare a custom proposal. All prices include taxes; travel outside Nairobi is charged at cost.
What the law requires
Staff training is one of the organisational measures data controllers and processors use to meet the Act. These are the provisions the course is built around.
| Rule or standard | What it requires | Applies to |
|---|---|---|
| Data Protection Act 2019, ss.41 and 42 | Organisational and technical measures to protect personal data. | Data controllers and processors |
| Data Protection Act 2019, s.24(7)(c) | The data protection officer facilitates capacity building of staff. | Organisations with a DPO |
| Data Protection Act 2019, s.43 | Notify the ODPC within 72 hours of becoming aware of a breach; processors notify the controller within 48 hours. | Data controllers and processors |
Recent developments and emerging issues
The course is updated as rules change. These are the developments it currently covers. Last reviewed: October 2026.
Registration renewal
The ODPC gave organisations with expired registration until 11 September 2026 to renew and warned unregistered entities of fines of up to KES 5m.
Posting a former employee's photos ruled unlawful
The ODPC also recommended prosecuting the bank's directors for not responding to the complaint.
ODPC Guidance Note on AI
An impact assessment is needed before using AI for recruitment screening, employee monitoring, credit scoring or fraud detection, and personal data may not be sent to offshore AI tools without a lawful transfer basis.
Enforcement to date
More than 9,000 complaints, 357 determinations, 20 penalty notices and 184 compensation orders.
Cybercrime law amended
A SIM-swap offence and data-preservation duties. Two provisions were struck down in July 2026.
Higher fines proposed
Proposed amendments would make fines the higher, not the lower, of KES 5m or 1% of turnover.
What your staff will learn
Each section ends with a short knowledge check. Learners who finish every section receive a certificate of completion.
Principles of the Act
The data protection principles in everyday work.
Lawful bases and consent
When you can collect and use personal data.
Data subject rights
Access, correction, deletion and objection requests.
Security and breaches
Keeping data safe and notifying the ODPC within 72 hours.
Sharing, processors and transfers
Working with vendors and sending data abroad.
Images and marketing
Photos, CCTV, direct marketing and social media.
AI tools and personal data
What the ODPC guidance means for staff using AI tools.
ODPC cases and review
Recent determinations and a review of the key points.
Training on the Kenya Data Protection Act 2019, with an FNJ certificate of completion. ODPC accreditation is not required to deliver data protection training, and FNJ is not on the ODPC's list of accredited training firms.
Records you can file
The evidence pack shows regulators and auditors who was trained, on what and when.
- 1Certificates of completionOne per learner who completes the course, with a unique number, the course, date and hours.
- 2Completion or attendance reportWho completed or attended, when, and in which edition.
- 3Knowledge check resultsScores from the checks at the end of each section.
- 4Course outlineThe content and the rules it addresses.
FNJ's data protection team
The same team provides outsourced data protection officer services and data protection compliance reviews.
CIPP/E
Certified Information Privacy Professionals (Europe).
Data protection training for an insurance broker
Data protection training for the staff of an insurance broker in Kenya.
Compliance services
Data protection compliance reviews and outsourced DPO support.
Compliance servicesOften taken together
Staff Compliance Essentials combines this course with related courses at 10% off when booked live or in person.
Staff Compliance Essentials
AML/CFT, ABAC and data protection for all staff.
On demand KES 24,000 per learner · 10% off live or in person
AML/CFT training for employees
Red flags, due diligence and reporting for all staff.
Course detailsPrice your training
Data protection training for staff is already ticked. Add other courses if you need them, then submit the form to see the payment details.
Questions about data protection training for staff
How do I get a data protection certificate in Kenya?
Every learner who completes this course receives a certificate of completion issued by FNJ. Professional DPO certifications are awarded by bodies such as IAPP or PECB.
How much does data protection training cost?
KES 8,000 per learner on demand, or KES 5,000 per learner per hour live or in person with a minimum of KES 8,000 per learner, inclusive of taxes.
Is the training ODPC-accredited?
No. ODPC accreditation is not required to deliver data protection training, and FNJ is not on the ODPC's list of accredited training firms. The course covers the Data Protection Act 2019 and its regulations.
What must staff do if they suspect a breach?
Report it internally at once, following your incident procedure, so the organisation can assess it and, where required, notify the ODPC within 72 hours.
Is there an edition for our sector?
Yes. There are editions for insurers and brokers, fintech and debt collection, NGOs handling beneficiary data, SACCOs and corporates.
Train your staff before the next breach
Tell us how many staff need training and by when. We reply within one working day.