Kenya's Office of the Data Protection Commissioner ordered a telecoms company to pay a former employee KSh700,000 over a single recorded video call. Nobody was hacked. No database leaked. An HR consultation about the man's exit was recorded after he had expressly refused consent, kept after he asked for it to be deleted, and later produced in an unrelated arbitration involving a sister company.
That determination marks a shift most Kenyan employers have not noticed: the personnel file is now a regulated asset. This piece sets out what the ODPC has decided in employment cases, which businesses must register as data controllers, how two Kenyan laws pull employee records in opposite directions on retention, and the habit that creates most of the exposure for small employers.
Key takeaways
- The ODPC has ruled that an employer recording and retaining an HR call without consent breaches the Data Protection Act, and ordered KSh700,000 in compensation.
- You are exempt from registering as a data controller only if you have fewer than ten employees and turnover under KSh5 million, and are not in a mandatory sector.
- The Employment Act requires written particulars to be kept five years after termination; the Data Protection Act says delete data once its purpose ends. Satisfying both needs a written retention schedule.
- Administrative penalties are capped at KSh5 million or 1% of the previous year's turnover, whichever is lower, and compensation orders to individual employees sit on top of that.
What the Liquid Telecom data protection ruling actually decided
The case is Alston v Liquid Telecommunications Kenya Limited, Complaint 1125 of 2025, determined on 3 November 2025 and reported by Kenya Law. The facts, as Business Daily and The Standard both covered them, were narrow. A former employee joined a virtual HR meeting about his departure, declined consent to recording, and was told the recording would be deleted. It was not, and it resurfaced later in a dispute involving a related company.
Three findings matter for every Kenyan employer. The ODPC treated the voice recording as personal data in its own right, not as neutral meeting minutes. It rejected the company's argument that it had a legitimate interest in keeping the recording for possible future disputes, because written minutes would have served the same purpose. And sharing the file with an affiliated company was a separate failure, not a continuation of the original purpose. The outcome was KSh700,000 payable to one individual.
Employee data is not the same as customer data
Most Kenyan businesses that have thought about the Data Protection Act 2019 thought about it in customer terms: marketing consent, SMS opt-outs, CRM records. Employment data carries a complication customer data does not, which is the imbalance of power. Consent from someone who depends on you for a salary is hard to call freely given, so employers often cannot rely on consent at all and must point to another lawful basis.
For most payroll processing, that basis already exists. The ODPC's 2025 guidance note on processing by micro, small and medium enterprises uses the example of a 25-employee manufacturer handling bank details, KRA PINs, NSSF and SHIF numbers, and confirms that processing employee data to meet statutory deduction duties is lawful. The problem is everything outside that core: the photo in a marketing post, the CCTV review, the recorded call, the WhatsApp group where payslips circulate.
In January 2025 the ODPC decided Kirima v Solar Panda Company Kenya Limited, Complaint 1618 of 2024, awarding KSh500,000 to a former field sales agent whose photograph appeared in company marketing. According to EY's reporting of the determination, commercial use of personal data requires express consent, and the burden of proving consent rests on the employer. The company could not produce a signed consent form. That was the end of it.
Does your business need to register with the ODPC?
This is where small Kenyan employers most often get the wrong answer. The common belief is that registration is for banks, hospitals and digital lenders. The ODPC's published guidance says the exemption applies only where a business has fewer than ten employees and turnover below KSh5 million. Meeting one of the two is not enough, and financial services, telecommunications, health, education and public bodies must register regardless of size.
That threshold catches many growing SMEs. A business with twelve staff and KSh4 million in turnover is in scope; so is one with six staff and KSh6 million. The certificate runs 24 months, with renewal due at least 30 days before expiry.
How long to keep employee records in Kenya
Section 10(6) of the Employment Act 2007 requires an employer to keep an employee's written particulars for five years after the employment ends. Section 10(7) adds the sting: if the employer cannot produce the contract or particulars, the burden of proving or disproving a disputed term falls on the employer. Kenya's tax rules separately require business records to be kept for five years, a period both PwC and Oraro state in their record-keeping guidance.
The Data Protection Act's storage-limitation principle says the opposite by default: do not keep personal data longer than its purpose requires. The two are compatible, but only if you can show which records you hold, under which obligation, and for how long. The ODPC's MSME guidance is explicit that where a law requires retention you follow that law, and that you should set written retention schedules stating purpose and duration. Without that document, "we keep everything" is not a policy, it is an admission.
The mistake most Kenyan employers make, and what it costs
The most common failure is not a breach. It is the absence of any record of why employee data is held and who may touch it, so when a complaint lands the employer cannot discharge a burden of proof the law has already placed on it.
That shows up as HR files on a shared drive every manager can open, payslips sent to WhatsApp groups that still contain former staff, and CVs from three years ago sitting in an inbox. Each is defensible if documented and indefensible if not, and in both determinations above it was the employer who had to prove the processing was lawful, and could not.
The price has two parts. Administrative penalties under the Act are capped at KSh5 million or 1% of the previous year's turnover, whichever is lower, with imprisonment of up to ten years for the most serious offences. Compensation orders to individual complainants sit on top, and that is the part employers underestimate: KSh700,000 to one person, repeated across a disgruntled team, exceeds most SME compliance budgets. On tallies reported by Kenyan legal practitioners in 2026, the ODPC has taken more than 9,000 complaints and issued more than 350 determinations, 134 enforcement notices, 20 penalty notices and compensation orders covering 184 complainants.
What the ODPC expects from a small employer
The MSME guidance is unusually practical. Appoint someone accountable for data, even part-time. Restrict personnel files to the people who need them. Lock the cabinet. Encrypt data in transit and at rest. Write a retention schedule. Sign a written data processing agreement with any payroll bureau or software vendor, and check the vendor is itself registered with the ODPC.
Then learn the clocks. A controller must notify the Data Commissioner within 72 hours of becoming aware of a breach, a timeline both the ODPC guidance and Bowmans' analysis of the Act confirm, and a processor must tell its controller within 48 hours. An employee's access request should be answered within seven days, a correction or deletion request within 14. Those are short windows for a business keeping HR records in a drawer and a spreadsheet.
Frequently asked questions
Can I record a disciplinary or exit meeting with an employee?
Only with a lawful basis, and the Liquid Telecom determination shows that "we might need it later" is not one. If you want a record, take written minutes and have both sides sign them. If you need audio, ask for consent, document the answer, say how long the file will be kept, and delete it then.
Do I need employee consent to process payroll in Kenya?
No. Deducting PAYE, SHIF, NSSF and the Housing Levy and remitting them is a legal obligation, which is its own lawful basis, and the ODPC's MSME guidance says so directly. Consent becomes relevant for things the law does not require, such as using a staff photo in marketing or sharing data with a parent company.
Can I still use WhatsApp to send payslips?
It is not banned, but it is hard to defend. A payslip is financial personal data, group membership changes without anyone noticing, and you have no record of who received or kept it. Issuing payslips through a system that authenticates the employee and logs delivery, with a system like Force HRM, removes the argument.
Build HR records that survive an audit
Compliance here is mostly an evidence problem, and evidence is what a proper system produces as a by-product of ordinary work: one record per employee, access limited by role, statutory deductions calculated and documented, payslips delivered to the person rather than a group chat, and a retention position you can explain. Force HRM is built for that in the Kenyan context, mobile-first, locally compliant with PAYE, SHIF, NSSF and the Housing Levy, and operable through AI assistants over MCP so an HR lead can ask for a record instead of digging for it. If your personnel files are spread across a drive, a drawer and a phone, start with payroll and HR records built for Kenyan compliance.
