Gambling industry given deadline to shape Kenya’s data protection rules
Kenya’s gambling operators have been invited to help shape upcoming data protection rules. The Office of the Data Protection Commissioner (ODPC) has released draft sector-specific guidance notes to support compliance with the Data Protection Act, 2019.
Operators have until 15 May 2026 to review the proposals and submit feedback. This consultation allows the industry to contribute to rules governing its operations. It also welcomes a more consultative approach from regulators overseeing Kenya’s fast-growing betting market.
Consultation window offers strategic input
The Office of the Data Protection Commissioner’s (ODPC) call for feedback gives operators a chance to shape practical compliance frameworks. Early engagement could help ensure that final decrees reflect operational realities across Kenya’s iGaming sector.
Stakeholders, including operators and industry representative bodies, are encouraged by the Commissioner’s office to submit their responses before the deadline. These submissions may focus on feasibility, cost implications, and clarity of enforcement expectations. Incorporating industry concerns into the final guidelines could reduce regulatory friction.
Data rules focus on Kenya’s iGaming operations
The draft guidance focuses on areas central to the operation of betting platforms. These include cross-border data transfers, internal data protection policies, and Data Protection Officer requirements.
Each area directly affects how operators manage user information across digital platforms. This includes identity data, payment details, and behavioural insights linked to betting activity. The guidelines also introduce expectations around accountability and structured data governance.
Potential to strengthen consumer trust
Kenya’s regulated gambling market may benefit from the clarity of data protection laws. Stronger safeguards for personal and financial data could reassure users about privacy risks.
This is particularly relevant in markets with high mobile gambling penetration. Trust-based relationships with operators can strengthen user loyalty and maintain a positive brand image. Operators aligning early with these expectations may gain a competitive advantage.
Operational adjustments likely
However, the proposal may require operators to reassess internal systems and compliance structures. Companies may need to update their data-handling processes to meet stricter documentation standards.
Existing contracts with third-party providers may also require revision to reflect new obligations.
This includes partnerships involving payment processing, cloud storage, and customer data management. Such changes could reshape how operators structure their technology and compliance teams.
Cross-border data rules raise complexity
The issue of cross-border data transfers is highly relevant for operators. While platforms maintain local copies of user data for compliance purposes, many operators primarily store personal data on servers offshore.
New policies may impose additional restrictions on where data may be transferred. Operators may seek further clarity regarding acceptable jurisdictions and compliance practices.
Compliance costs and regulatory pressure
While this consultation process offers industry collaboration and operator input, it still signals tighter enforcement ahead. Operators are likely to face higher compliance costs, including the need to hire specialised personnel and increased operational expenses.
Smaller companies may feel the impact more than larger, established operators. Additionally, failure to comply with the Data Protection Act, 2019 could result in penalties and reputational risks.
The importance of industry collaboration
Other jurisdictions across Africa have also worked to improve their data protection laws. Late last year, the Association of Nigerian Bookmakers (ANB) and the Nigeria Licensed Lottery Operators’ Forum (NLLOF) met with officials from the Nigeria Data Protection Commission (NDPC) to discuss ways to improve data protection practices within the industry.
Such meetings are a great example of effective cross-organisational collaboration. Stakeholders can have a say in regulations that directly affect them and their players.
Gambling industry influence ahead of enforcement
The 15 May 2026 deadline requires operators to respond quickly and strategically. Those engaging early may help shape a more balanced regulatory framework for the sector.
The outcome of this consultation could define how data protection is enforced across Kenya’s gambling industry.
Asia’s undisputed regional heavyweight lands in Manila, 31 May to 03 June 2026. Backed by PAGCOR and powered by 16,000 delegates, SiGMA Asia delivers two levels of game-shaping influence. If you’re serious about the region, this is the room for you.
