Collecting consumer data at activations: what Kenya’s Data Protection Act asks of brands

A good activation creates a moment people remember. It often also creates a spreadsheet: names, phone numbers and emails gathered on tablets, scratch cards and paper forms. That list is valuable, and in Kenya it is regulated.

The rule in one sentence

Section 37 of the Data Protection Act, 2019 says personal data may not be used for commercial purposes unless the person has given express consent, or a written law allows it, and they were told about that use when the data was collected.

The Data Protection (General) Regulations, 2021 add the practical conditions for direct marketing. In short, the data should come from the person themselves, they must be told that marketing is one of the purposes, and there must be consent or a simple opt-out in every message.

What that means on the activation floor

• Say why, in plain words, before you collect. "We'll SMS you offers from [Brand]. Reply STOP to opt out." A tick box that is already ticked is not express consent.
• Collect only what the promotion needs. A raffle needs a phone number. It rarely needs an ID number, date of birth or home location.
• Keep consent separate from entry. People should be able to enter a draw without agreeing to marketing.
• Record the consent. Keep the wording, the date, the venue and the device, so you can show what the person agreed to.
• Give every message an opt-out that is free and works, and honour it across all your lists.
• Do not hand the list to third parties unless people agreed to that too.
• Set a deletion date. Keep the data only as long as the stated purpose needs it.

Agencies are processors. When DBM runs data capture for a brand, the brand decides why the data is collected (the controller) and we process it on its instructions. That relationship should be written into the contract, including security, confidentiality and deletion at the end of the campaign.

Registration and penalties

The Registration Regulations require some organisations to register with the Office of the Data Protection Commissioner whatever their size, including businesses that are wholly or mainly in direct marketing. The Commissioner can impose an administrative fine of up to KES 5 million or 1% of the previous year's turnover, whichever is lower, besides any order to stop processing.

A simple checklist for your next campaign

1. Write the purpose and the consent wording before the forms are designed.
2. Use a separate, unticked marketing box.
3. Capture only the fields you need.
4. Store the data encrypted, with access limited to named people.
5. Agree a deletion date with your agency and confirm it in writing.

Planning an activation that collects consumer data? Talk to us about consent-ready forms and secure capture.