Skip to main content

​
Kenya CA Sender & Marketing Rules

Kenya regulates commercial messaging through the Communications Authority of Kenya (CA) under the Kenya Information and Communications Act, and personal data through the Data Protection Act 2019 (DPA 2019), enforced by the Office of the Data Protection Commissioner (ODPC). The DPA names consent as the footing for electronic marketing, the CA and the operators shape which sender identities Kenyan networks deliver, and the national opt-out register conversation shapes how tenants scrub Kenyan lists. Scope. Your organization owns the lawful basis for each market, including any duty to consult a national register. Orbit ships tenant-owned controls only — the consent ledger, suppression, the DNC scrub, keyword aliases, quiet hours, sender-registration tracking, and the send-gate — defaults-open; you configure them for Kenya. This page is documentation, not legal advice.
Enforcement exposure is two-track: the ODPC administers administrative penalties under the DPA 2019 and has fined organizations for marketing without a lawful basis, and Kenyan operators rewrite or filter sender identities that are not registered for the route. Confirm the current register position with Kenyan counsel before you launch.

​
1. Sender IDs: CA-routed pre-registration

Read the live KE row of GET /compliance/country-rules?channel=sms on Country Compliance Requirements before you provision. Kenyan operators deliver alphanumeric sender IDs that are registered for your traffic route under the CA’s licensing frame; an unregistered identity is rewritten or filtered at the operator edge.
File the alphanumeric sender through Sender-ID Registration and keep KE traffic in rehearsal until the entry reports approved. Where the live row reports registration: required without an approved entry, the send-gate holds KE traffic — intended behavior, not a fault.
The DPA 2019 requires consent for processing personal data for electronic direct marketing unless another lawful basis documented at collection applies — treat KE promotional traffic as opt-in with a standing opt-out path. Record the consent entry with sms scope, the purpose, and the consent-text version on the consent ledger before the first send; the tenant-owned unknown-marketing policy at its refuse default is the correct posture for Kenya-bound promotional traffic. The DPA also gives data subjects rights of access, correction and erasure; keep withdrawal effective across imports and campaigns and route requests through your DSAR process.

​
3. The national opt-out register: tenant owns the scrub

Kenya’s consumer-protection framework provides for a national do- not-contact register for users who decline marketing contact. Whether the register is currently operational, which traffic classes it covers, and who must consult it are questions of Kenyan law that change; confirm the current position with counsel. What does not change is who carries the duty: the tenant. Orbit’s side of the register is the scrub surface, not the register itself. Run Kenyan campaign lists through DNC Scrub against any applicable register source, keep the tenant suppression ledger current via Opt-Out & Suppression Lists, and apply the directory rule from the hub: absence from a registry does not establish consent, and a register check never replaces the consent record. When the register’s applicability to your program is confirmed, wiring it into your recurring scrub is a tenant configuration decision, not a platform change.

​
4. STOP vocabulary and marketing window

English is the working language of Kenyan A2P traffic, with Swahili SIMAMISHA (stop) as the natural local term. Publish the keyword your consent text references and, where recipients include Swahili speakers, extend the Opt-Out Keyword Alias Table with a KE-targeted SIMAMISHA alias; the seeded English family already matches STOP. Honor replies at scope all so a contact who stops your SMS is not then voice-dialed by the same program. Kenya has no codified national no-send window; the operator-honored convention keeps marketing out of the overnight hours (21:00–08:00 recipient-local is the conservative window). Set tenant quiet hours to cover it on Quiet-Hours Configuration and validate the +254 resolution with Quiet-Hours Preview. Kenya runs fixed UTC+3 with no daylight saving, so the window applies the same offset all year.

​
5. Obligations → Orbit surface table

​
6. Launch checklist

  1. Distinguish promotional from service traffic; treat KE marketing as opt-in.
  2. Read the live KE row per channel: sender types, registration level, stop requirement.
  3. File the alphanumeric sender and wait for approved before sending under it.
  4. Record consent with sms scope and a pinned consent-text version before any send.
  5. Run the list through DNC scrub against applicable sources and confirm your suppression ledger is current; confirm register applicability with counsel.
  6. Publish STOP (and SIMAMISHA where your audience includes Swahili speakers) and confirm replies write suppression rows.
  7. Set tenant quiet hours over the overnight recipient-local window; test with a small audience first.

​
Frequently asked questions

Does Orbit consult the Kenyan register for me? No. The duty to consult a national register is the tenant’s; Orbit supplies the scrub surface (DNC Scrub) you point at the sources your counsel names, and your suppression ledger keeps the evidence. Does registration with the CA replace consent? No — sender registration governs origination; the DPA 2019 consent duty is a separate track with its own evidence. Is Swahili STOP handling mandatory? The mandatory part is a working opt-out honored promptly; publishing the local term your audience actually uses is the practice that keeps revocations reachable. Extend the alias table for SIMAMISHA where Swahili speakers are in your audience.