The framework
The operative statute in Kenya is the Data Protection Act 2019, enforced by the Office of the Data Protection Commissioner.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Data Protection Act 2019
Kenya's ODPC is East Africa's pacesetter: registration of controllers and processors, a steady stream of penalty notices (including against digital lenders and schools over marketing and children's images), and functioning complaint machinery. Compliance built for the GDPR maps over cleanly.
Marketing and advertising
GDPR-modeled bases; direct marketing requires consent or an existing-customer relationship with opt-out, and the ODPC enforces this. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Adequacy, safeguards or consent; the Cabinet Secretary can require certain processing to run on servers in Kenya on grounds of strategic state interest or revenue protection.
Enforcement and penalties
Up to KES 5M or 1% of the preceding year's annual turnover, whichever is lower.