In February 2026, the Nation reported that Kenya’s Office of the Data Protection Commissioner (ODPC) had ordered a Nairobi recruitment consultancy to pay a job seeker KES 262,500. The firm had sent her CV to a third party without her express consent, and she said it caused her emotional distress.
The firm, Brites Management Services Limited, said it recruits on behalf of employers as well as matching job seekers to them. According to a legal summary of the decision, the ODPC found that an automated email telling candidates this did not give the firm a lawful basis to process her personal data.
The practical point for anyone recruiting in Kenya is that a CV is personal data, and passing it to a client employer is a disclosure that needs a lawful basis. Saying in an automated email that you recruit for employers was not enough in this case.
What the law asks of you
The Data Protection Act, 2019 came into force on 25 November 2019. The Data Protection (General) Regulations, 2021 add detail on consent. Where you rely on consent, you must tell the person who you are, why you are using their data and what data you hold. You must also tell them whether it feeds any automated decision-making, that they can withdraw consent and what follows if they do, whether the data may leave Kenya, and whether it will be shared with third parties. Consent has to be voluntary and specific to the purpose.
The Regulations also say that where you use different lawful bases for different purposes, you must keep them distinct instead of bundling them into one. A single tick-box covering the storage of a CV, its submission to clients and marketing emails is hard to square with that.
Organizations above certain thresholds must also register with the ODPC as data controllers or processors. The Regulations exempt some small organizations from registering, based on turnover and headcount. That exemption is from registration, not from the Act itself, so check whether your firm is covered before assuming it is not.
Hiring checks are covered too
Background and reference checks fall under the same law. A Nation report on the regulator’s rulings says the ODPC found that adverse information used in recruitment must be disclosed to the candidate on request, and that background reports are personal data. BrighterMonday’s guidance to employers makes similar practical points: get explicit consent before a background check, collect only what you need, and be ready to give a candidate copies of the data you hold about them.
Steps worth taking now
- Tell candidates when they apply who will see their CV. If you may send it to client employers, say so, and get their agreement before each submission, ideally naming the employer.
- Keep a record of what each candidate agreed to, and when.
- Treat a forwarded CV, an email attachment or a message to a hiring manager’s phone as a disclosure to a third party. The channel does not change that.
- Ask for what the role needs and no more.
- Decide who answers a candidate who asks to see what you hold on them, and how quickly.
- Find out whether your firm must register with the ODPC.
These steps are the Ring’s practical reading of the rules, not legal advice. For anything specific to your business, speak to a lawyer, and start with the ODPC’s own guidance note on consent.
