What is consent under the Data Protection Act?
A person’s informed agreement to be checked.
Definition
Consent is a person’s informed, freely given agreement for their personal data to be processed. Under Kenya’s Data Protection Act it is a common lawful basis for running sensitive checks.
In plain English
In plain English: consent means a person has knowingly and freely agreed to have their personal data checked or used. Under Kenya’s Data Protection Act it must be a clear, affirmative agreement — not silence, inactivity or a pre-ticked box.
Why it matters
Consent-led verification keeps you compliant, builds trust with the people you check, and creates a defensible audit record.
Verify with confidence — start free
No subscription · pay per check · consent built in
The tests of valid consent
Under Kenya’s Data Protection Act, consent is an express, unequivocal, free, specific and informed agreement — given by a statement or a clear affirmative action. In practice that means it must be:
- Freely given — a real choice, with no penalty for saying no.
- Specific — tied to a clear, stated purpose, not bundled with unrelated ones.
- Informed — the person knows who you are, what data, why, and their rights.
- Unambiguous — a positive act, never silence, inactivity or a pre-ticked box.
How to obtain consent properly
- Ask in plain language, separately from other terms and conditions.
- Keep it granular — separate consent for separate purposes.
- Make refusing as easy as agreeing.
- Record what the person agreed to, and when.
Withdrawing consent
A person can withdraw consent at any time, and it should be as easy to withdraw as it was to give. Once withdrawn, you must stop the processing that relied on it.
You must be able to prove it
The data controller bears the burden of proving that valid consent was obtained. That is why a clear, stored record of the consent — what was agreed and when — is what makes a decision defensible later.
Related on Verifisha
Run this kind of check with consent
Verifisha helps Kenyan teams verify people and businesses, with consent built in.
No subscription · pay per check · consent-led & ODPC-aligned
Or get verified yourself
It is not only for checking other people — verify your own identity and build a vetted, shareable trust profile you can send to employers, landlords or partners. Get verified once and reuse it everywhere, with consent.
Frequently asked questions
What is consent under the Data Protection Act?
It is a person’s express, freely given, specific and informed agreement — by a statement or a clear affirmative action — to have their personal data processed.
Do I always need consent to process personal data?
No. Consent is one lawful basis; the Act recognises others (such as a contract or legal obligation). But for verification and background checks, consent is usually the cleanest and safest basis.
Can consent be withdrawn?
Yes — at any time, and as easily as it was given. You must then stop the processing that relied on it. Verifisha supports profile-sharing links with expiry and revocation.
Do I need to keep proof of consent?
Yes. The data controller bears the burden of proving consent was obtained, so keep a record of what was agreed and when. Verifisha stores each approval as audit-ready evidence.
Verify anyone — or get verified yourself.
Run consent-led KYC, KYB, AML, CRB and background checks in one place — or build your own verified, shareable trust profile for jobs, rentals and deals. Trust made simple, for Kenya and Africa.