Summary

SMEs (small and mid-size enterprises) play a crucial role in job creation and contribution towards the Gross Domestic Product (GDP) in Kenya. In order to reach many customers, SMEs have embraced digitalization and some are utilising personal data to advertise products to potential customers. Various direct marketing tools are now being used to reach customers and this has been made possible through the use of social media, email and also applications designed for sending text messages. The use of personal data for commercial purposes means that SMEs are required to comply with data protection requirements.

This SME manual on commercial use of personal data (direct marketing) in Kenya is meant to inform SMEs of the legal and regulatory landscape that govern the commercial use of personal data. It is also designed to enable SMEs grasp fundamental terminologies involved in direct marketing and the data protection requirements they are supposed to comply with when engaging in direct marketing practices. For compliance purposes, the manual contains a checklist formulated in accordance with the Data Protection Act 2019 and the Data Protection General Regulations 2021 that will enable marketers to comply with the law and avoid sending unsolicited communication to potential customers.