What you are looking for might be the Data Protection bill 2012. It has passed through the cabinet but unlike the access to information did not pass / was not discussed in parliament.

From: Derrick Wesonga via skunkworks
Sent: Monday, November 27, 2017 14:52
To: Skunkworks Mailing List
Cc: Derrick Wesonga
Subject: [Skunkworks] Data Privacy in Kenya

Hi Skunks,

Does any one have an idea of laws covering user data protection in Kenya, in particular user data collected online? What am looking for are laws governing user data collected by institutions such as phone numbers and emails companies collect during sign up.

So far I have seen http://info.mzalendo.com/media_root/file_archive/Access_to_Information_Bill_2015.pdf and http://kenyalaw.org/kl/fileadmin/pdfdownloads/bills/2016/CyberSecurityandProtectionBill_2016.pdf which apparently was not passed, but it does not cover business organizations.

regards,

Derrick