Kenya's Data Protection Act: what beauty professionals need to know

Every client you book gives you their name and phone number. Many also tell you about allergies, their hair history or their skin. Under Kenya's Data Protection Act, 2019, that is personal data, and you are responsible for how you use it.

The good news: for most independent beauty professionals, staying on the right side of the law takes a few habits, not a lawyer on retainer. This guide covers what the Act asks of you and how to do it day to day.

This is general information, not legal advice. If your situation is unusual, speak to a data protection advocate.

You are the "data controller"

The Act calls whoever decides how personal data is used the data controller. When you keep a client list, that is you, whether the list lives in a notebook, your phone's contacts or an app.

Any software you use to store that list, Miali included, is a data processor: it handles the data for you, on your instructions. Miali's Data Processing Agreement sets out what it does with your clients' data.

Do you need to register with the ODPC?

The Office of the Data Protection Commissioner (ODPC) keeps a register of data controllers. You are exempt if both of these are true:

1. Your annual turnover is below KES 5 million, and
2. You have fewer than 10 employees.

Most solo stylists, nail techs, lash artists and barbers fall under that line. If you meet only one of the two conditions, you need to register.

Some sectors must register whatever their size, and health is one of them. If your business offers IV drips, medical skin treatments or anything that looks like patient care, plan to register. For a micro or small business the fee is KES 4,000, and the certificate lasts 24 months.

What the law asks of you

1. Tell clients what you do with their details

Clients should know who holds their details and why. A short line is enough: "I keep your name and number to manage your bookings and remind you of appointments."

2. Only send offers to clients who said yes

Reminders and confirmations are part of the service a client asked for. Offers are different. "20% off this weekend", "We miss you, come back" and birthday promotions count as direct marketing, and the Act says you need the client's agreement first. Every offer must also give them an easy way to stop.

This applies to your own WhatsApp too. A broadcast of offers to your whole contact list is direct marketing.

3. Treat health information with extra care

Allergies, skin conditions and reactions to products are health information, which the Act calls sensitive. Note them only when you need them for the client's safety, and only with their agreement. Never share them.

4. Let clients see, correct or delete their details

A client can ask what you hold about them, ask you to fix it or ask you to delete it. Respond promptly and politely.

5. Keep it safe, and act fast if something goes wrong

Use a phone lock, don't leave client lists on shared devices and don't send client details to people who don't need them. If client data leaks, for example a lost phone with your client list, the controller must tell the ODPC within 72 hours.

How Miali helps you do this

We built these into Miali so the law is mostly handled for you:

1. Your booking page tells clients you use Miali to manage bookings, and offers an unticked box to get your offers. Clients who tick it are recorded as agreeing.
2. Offers only go to clients who agreed. Each client's profile has an "Agreed to offers" switch for clients who said yes in person. Messages and review requests sent through Miali skip everyone else.
3. Clients can stop messages themselves by replying STOP on WhatsApp or using the unsubscribe link in any email.
4. You can pause messages to any client from their profile.
5. Allergy notes need the client's agreement before Miali saves them, and they never appear in messages.
6. Download or delete a client's data from their profile when they ask. Deleting keeps your past revenue in your reports without anything that identifies them.

A quick checklist

1. Check whether you need to register with the ODPC (most solo pros don't, health services do).
2. Ask new clients if they'd like your offers, and record their answer.
3. Only keep allergy notes when you need them, and with the client's agreement.
4. Answer requests to see or delete details promptly.
5. Lock your phone and keep your client list off shared devices.

Questions about how Miali handles your clients' data? Read our Data Processing Agreement and Privacy Policy, or email privacy@miali.app.