Data Localization in Kenya and its Implication on the Digital Economy

Why is the World Bank now urging the country to revoke this law under the Data Protection Act?

With the aim of bolstering cross-border trade in digital services, the World Bank has urged Kenya to reevaluate its Data Protection Laws, which currently require the storage of sensitive personal data within the country. This piece examines the impact of these data localization laws on Kenya’s digital economy and delves into the World Bank’s suggestions for a more seamless global approach.

What is Data Localization and the Legal Framework on it?

The requirements for data localization are detailed in the Data Protection General Regulations of 2021.

Data localization pertains to the mandate for data processing to occur exclusively through a server and data center situated within Kenya. It necessitates that at least one duplicate copy of the personal data must be retained within a data center located in Kenya. This requirement applies to various fields including national civil registration systems, population registers, identity management, facilitation of primary and secondary education, management of licensed electronic payment systems, revenue administration, processing of health data, and critical infrastructure.

Furthermore, according to the Health Information System Policy, there exists a provision stipulating that health data should not be stored outside the territorial boundaries of Kenya. While not legally binding, this policy holds persuasive weight, and in situations where statutory provisions are absent, courts are likely to be influenced by policy considerations, particularly if they align with the Constitution and established legal precedents.

The Impact of Data Localization Laws

These laws have been identified by the World Bank as a potential bottleneck for cross-border trade in digital services. These laws require companies to store sensitive personal data exclusively on servers located within Kenya. While such regulations may have been implemented with the intent of safeguarding data privacy, they inadvertently create barriers to international trade in the digital sphere.

The World Bank’s Perspective

The World Bank has proposed a comprehensive upgrade to Kenya’s legal framework, advocating for the removal of data localization requirements. To fully unlock the potential of Kenya’s digital economy, the World Bank suggests a targeted revision of policies, including the Data Protection Act and the Health Information System Policy. Specifically, the Bank advises reducing data localization requirements, particularly for privately generated personal data.

Conclusion

Kenya’s digital landscape has witnessed an influx of global industry leaders, who have played a pivotal role in driving job creation and contributing to the country’s economic output. By reconsidering data localization laws, Kenya can fortify its position as a hub for digital innovation, attracting further investment and bolstering its digital economy.

The legal community watches with anticipation as Kenya takes steps toward this transformative shift in its digital policy landscape.