The Data Protection Act,2019 is a comprehensive law that came into force to give effect to article 31(c) and (d) of the constitution, to make provisions for the regulation of processing of the personal data, to provide for the rights of the data subjects and obligations of data controllers and processors, and for connected purposes. This Act has several implications for businesses operating in Kenya.

Example of such implications:
i) The Act helps business owners identify the already established legal and institutional mechanism to protect their personal data.
ii) Another implication is that companies and business owners are provided with rights and remedies to protect their personal data from processing that is not in accordance with the Data Protection Act,20129.
iii) The DPA applies to both private and public institutions such as banks which are required to conduct regular monitoring of customer transactions which protects business owners from fraud and misrepresentation. It also helps in identification of suspicious trade, and this mandates the business owners to involve such institutions in conducting their businesses to ensure constant monitoring of their data.
iv) The Act guarantees the privacy of the individuals and companies is protected. For example, the DPA introduces the requirement of financial institutions to comply with data protection principles, such as data minimization when discharging their Know Your Customer obligations.
v) It promotes international cooperation in matters relating to data protection under international conventions and agreements which improves the relationship amongst business owners worldwide, this helps improve markets and connectivity.