CCTV and the Data Protection Act in Kenya

Most people who call us about CCTV ask the same first question: is it legal to install CCTV in Kenya? In general, yes. Nothing stops a homeowner or a business from putting up cameras. What has changed since the Data Protection Act, 2019 is what you are expected to do once those cameras are recording people. A shop recording customers, a landlord recording tenants at the gate and a family recording its own compound are treated differently, and a camera that looks over the wall into a neighbour's home has already cost one Kenyan homeowner real money.

This is general information, not legal advice. We are installers, not lawyers. The rules and how the Office of the Data Protection Commissioner applies them can change. Before you rely on anything here, check with the ODPC at odpc.go.ke or speak to a lawyer about your own situation.

What the law says, in plain terms

Below is everything we state about the law on this page. Each point links to the source we took it from, so you can read it yourself.

• Business and workplace CCTV is covered by the Data Protection Act, 2019. A camera that records identifiable people is collecting personal data. As reported by Kenyans.co.ke, operators of workplace or business CCTV should register with the ODPC and notify people that they are being recorded, which in practice means signage.
• A DPIA is expected where cameras cover publicly accessible areas. A Data Protection Impact Assessment is a written review of what you record, why, the risks to the people recorded and how you reduce those risks. The same report describes this expectation for cameras over shop floors, reception areas and similar spaces.
• Purely domestic CCTV is generally exempt. Cameras a household uses for its own home are generally outside the registration duty, according to the same source. "Purely domestic" is the important phrase, and the neighbour cases below show where it stops.
• Reported penalties are large. Up to KSh 5 million for failing to register and up to KSh 3 million for unlawful disclosure of data, as reported here.
• Not every business has to register. The Data Protection (Registration of Data Controllers and Data Processors) Regulations, Legal Notice 265 of 2021 set thresholds. A business with an annual turnover under KSh 5 million is exempt from registration unless it processes data for one of the purposes listed in the Third Schedule. Read the Third Schedule yourself, or ask the ODPC, before deciding you are exempt.
• Neighbours have won cases over cameras. In 2023 the High Court found that cameras aimed at a neighbour's property in Kilimani, Nairobi infringed the right to privacy under Article 31 of the Constitution (judgment on Kenya Law). In late 2025 an ODPC determination was reported ordering a homeowner to pay a neighbour KSh 200,000 because their CCTV captured the neighbour's home (Money254 report).

Checklist: homes, businesses and landlords or estates

Use the column that fits you. Where a box says "check", that is a question for the ODPC or a lawyer, not something we can settle for you.

A home that points one camera at the street to watch the gate is still mostly domestic. The trouble starts when the camera's field of view keeps a neighbour's door, windows or compound on screen all day. That is exactly what the two neighbour cases above were about.

Neighbour CCTV and privacy: how we set cameras up

Neighbour disputes are the most common CCTV complaint we hear about, and most of them come down to where a camera was pointed on the day it was fitted. When we install in Nairobi, or when you do it yourself, these habits keep you on the right side:

• Angle cameras into your own space. Aim gate and perimeter cameras along your own wall or down onto your own driveway, not across the road at the house opposite. A slightly lower, steeper angle usually gives a better view of faces at your gate anyway.
• Use privacy masking. Most current Hikvision and Dahua cameras and NVRs let you draw a black box over part of the picture so it is never recorded or shown. Mask a neighbour's window, balcony or gate that you cannot avoid catching. Do it at installation, take a screenshot of the masked view and keep it.
• Choose the lens for the job. A wide lens on a camera over the gate will pick up the neighbouring compounds. A narrower view, or a camera mounted further along the wall, often solves the problem without masking. Our guide on how to choose a CCTV camera covers lens choice.
• Think about audio. Some cameras record sound. Recording conversations over the wall is a far bigger intrusion than video of your own driveway. Switch the microphone off unless you have a clear reason.
• Talk to the neighbour first. If a camera has to face a shared boundary, show them the masked view on your phone. It costs nothing and heads off a complaint.

A camera such as the Hikvision ColorVu 1080p (KSh 3,400) or our general CCTV camera (KSh 8,200) can be aimed and masked like this. Browse more options in CCTV and surveillance.

CCTV signage in Kenya: what to put on the sign

Notice is one of the duties reported for business CCTV, and a sign is the simplest way to give it. Put it where people see it before they enter the recorded area: the shop door, the gate, the reception desk, the entrance to parking. A sign hidden behind the counter does not help. Example wording you can adapt:

CCTV IN OPERATION. This area is monitored and recorded for security and the safety of staff and visitors. The system is operated by [business or estate name]. For questions about the footage, contact [phone number] or [email address].

Keep it short, readable from a few metres away and in the language your customers or tenants read. If you serve a mixed audience, add a Kiswahili line. Name who runs the system and how to reach them, because that is who people will ask when they want to know what was recorded.

Retention, access and the DPIA in practice

How long to keep footage

The sources above do not set a fixed number of days for CCTV. What decides retention in a real system is the hard disk: the recorder overwrites the oldest footage once the disk is full. So choose a period you can explain, then size the disk to match. For a shop or office, two to four weeks is usually enough time to notice an incident and pull the clip. Keeping months of footage "just in case" is harder to justify and means more data to protect. Our CCTV hard disk calculator shows how many days a given disk holds; a 1 TB WD hard disk (KSh 5,300) suits a small home system, while a 4 TB hard disk (KSh 14,000) gives a busier site more room.

Who can view footage

• Give each person their own login on the NVR and the phone app. Do not share the admin password with the guard, the cleaner or a caretaker.
• Decide who can view live, who can play back and who can export. In most businesses one or two people need export rights.
• Do not post clips in WhatsApp groups or on social media. The reported penalty for unlawful disclosure is up to KSh 3 million.
• When police or an insurer asks for a clip, export only the relevant minutes and note who received it and when.
• Change the default passwords and keep the recorder in a locked cabinet or room so footage cannot simply be carried away.

The 16-channel Hikvision NVR (DS-7616NI-Q2/16P) at KSh 26,000 supports separate user accounts with different permissions, which makes these rules easy to enforce.

A DPIA without the jargon

If your cameras cover a shop floor, a reception or an estate gate, write down in a page or two: where each camera points and why; what you are trying to prevent; who is recorded (customers, staff, visitors, passers-by); how long footage is kept; who can see it; and what you did to reduce intrusion, such as masking, no audio and no cameras in toilets or changing rooms. Ask the ODPC whether your DPIA needs to follow a particular format.

Landlords, estates and employers: extra points

Estates and apartment blocks sit between home and business. Recording the gate, parking and corridors means recording tenants, their visitors and domestic workers every day. A management company or landlord running that system should not assume the household exemption covers it. Check registration with the ODPC, put up signs at every entry point, keep cameras out of views into individual flats and agree in writing who in the management team or security company can view footage. Our guide on access control for apartments and estates covers the gate side of the same problem.

Employers recording staff should tell them in writing where the cameras are and what the footage is used for. Cameras in offices and stores are normal. Cameras in toilets, changing areas or staff rest rooms are not. If you are planning the system from scratch, how many cameras a Nairobi shop needs and CCTV installation cost in Kenya are good next reads.

If you want us to plan camera positions with privacy in mind, send a few photos of the site on WhatsApp at +254 718 811 661 or through our contact page. We install in Nairobi, and we deliver equipment anywhere in Kenya for a flat KSh 300 with cash on delivery.