Calls
Call recording in Kenya for business: what the law requires and how to record
10 November 2026 · 8 min read
The short answer
A business in Kenya that records calls is processing personal data under the Data Protection Act, 2019. It should tell callers before recording, have a lawful basis, use the recording only for the stated purpose and keep it no longer than needed. SautiDesk puts each recording on the customer’s ticket, with 1 GB of storage free.
A business in Kenya can record customer calls, and the Data Protection Act, 2019 sets what it must do when it does. The Act lists “recording” as a form of processing, and a recording of a customer’s voice, with their name and account details in it, is information about an identifiable person, so it is personal data. The business must tell callers, have a lawful basis, use the recording for a stated purpose, and keep it no longer than it needs. The rest of this guide takes those duties one at a time and then shows how to record on SautiDesk.
What does the law require when a business records calls?
The duties below are read from the official text of the Data Protection Act, 2019 and the 2021 regulations made under it, as published by the Office of the Data Protection Commissioner (ODPC) and read on 10 November 2026. The table gives the section so you can read the wording yourself.
| Duty | Where | What it means for call recording |
|---|---|---|
| Tell the person before collecting their data, in so far as practicable: that data is being collected, why, their rights and who else may receive it | Act, section 29 | Play a notice at the start of the call |
| Have a lawful basis: the person’s consent, or that processing is necessary for a contract, a legal obligation or your legitimate interests, among others | Act, section 30 | Decide which basis applies and write it down |
| If you rely on consent, you carry the burden of proving it, and the person may withdraw it at any time | Act, section 32 | Keep a record that the notice was played, and stop if the caller refuses |
| Collect data for explicit, specified and legitimate purposes, limited to what is necessary | Act, section 25 | State a purpose such as quality, training or disputes, and use the recording for that |
| Keep personal data only as long as reasonably necessary, then delete, erase or anonymise it | Act, section 39 | Set a retention period |
| Establish a personal data retention schedule with a purpose, a period and periodic review | Regulations, regulation 19 | Write the schedule down |
| Erase data on request where you are no longer authorised to keep it, or it is irrelevant, excessive or obtained unlawfully | Act, section 40(1)(b) | Have a way to find and remove one caller’s recording |
| Respect the person’s right to object to processing | Act, section 26(c) | Take a refusal seriously, and stop recording that caller |
Two limits apply to all of this. Processing by an individual for a purely personal or household activity is exempt (section 51(2)(a)), and that exemption does not cover a business recording its customers. And the penalties are real: the Data Commissioner can fine up to five million shillings or, for an undertaking, up to one per cent of its annual turnover of the preceding financial year, whichever is lower (section 63), and a person who suffers damage from a contravention is entitled to compensation (section 65).
Do you have to tell callers you are recording?
Yes, tell them before the recording starts. Section 29 asks you to inform the person before collecting their data, in so far as practicable, of the fact that data is being collected and the purpose. A short spoken notice at the start of the call does this. Say it in the language the caller uses.
On SautiDesk, if your phone menu is on, put the notice at the start of the greeting. The greeting is either text that is read out or a recording you upload as an MP3 or WAV file up to 60 seconds. If the menu is off, calls ring your queue directly, so agents say the notice themselves in the first sentence. What is IVR covers how to write the greeting.
What changes for a clinic, a school or a SACCO?
Data revealing a person’s health status is sensitive personal data under section 2, and section 44 allows sensitive data to be processed only where the section 25 principles are met. A clinic that records booking calls should keep the recording limited to the purpose, and limit who can play it. Property details, marital status and family details are also on the Act’s sensitive list, which matters for a SACCO or a school.
Registration is the other point. Section 18 says nobody may act as a data controller or processor unless registered with the Data Commissioner, subject to thresholds. The 2021 registration regulations exempt a controller with annual turnover or revenue below KES 5 million and fewer than ten employees (regulation 13(2)), but their Third Schedule lists purposes whose controllers must register, including health administration and the provision of patient care, the provision of financial services, operating an educational institution and the hospitality industry. Check the current register and the regulations on odpc.go.ke for your own business.
How long should you keep recordings?
Keep a recording only as long as you need it for the purpose you gave. Section 39 and regulation 19 ask for a written retention schedule, so pick a number and write it down. Training and quality recordings are usually reviewed within weeks. A recording that settles a dispute about an order or a payment may need to stay until the dispute is closed. SautiDesk keeps recordings for as long as you use it, so the period you write down is the one you enforce. Raise any recording past its period, or one a caller has asked you to erase, with SautiDesk support.
How do you record calls on SautiDesk?
On SautiDesk each recording sits on the customer’s ticket, next to the call it belongs to, so anyone with access to the ticket can find and play it. While a call is being recorded the agent’s call panel shows “This call is being recorded”. On Pro supervisors can also listen to a live call to coach a new agent, without the customer hearing them.
Recordings count toward your workspace storage, together with tickets, messages, call logs and files. The first 1 GB is free. The paid tiers are in the table, and they apply to the whole workspace.
| Tier | Size | Price a month |
|---|---|---|
| Free | 1 GB | KES 0 |
| Starter | 10 GB | KES 999 |
| Growth | 100 GB | KES 6,999 |
| Scale | 500 GB | KES 24,999 |
Calls themselves cost the usual rates: incoming calls are free, and outgoing calls are KES 0.05 per second from your prepaid balance, with a number at KES 500 a month. Recording has no per-minute charge on SautiDesk. See the pricing page for the full list, and missed calls for how an unanswered call becomes a ticket with an owner.
Why a personal phone recorder does not work for a team
A recorder on one employee’s phone keeps the recording on that phone. It covers only the calls made or answered there, and it leaves the business when the employee does. A business needs the recording attached to the customer’s record, available to the people who handle that customer, and deleted on a schedule. That is the case for recording on the business line rather than on handsets. Start a call centre in Kenya covers the rest of the set-up.
If you keep your own phones or PBX
If your team stays on desk phones or a PBX, or your developers handle calls in code, point a Kenyan number from Sautikit at them. A Sautikit number is KES 500 a month with no set-up fee, incoming calls are free, and outgoing calls are KES 3.00 a minute billed per second. Recording is free to make and uses storage: the first 100 MB is free and kept for 24 hours, and the paid tiers are 1 GB for KES 599 a month (kept 3 days), 4 GB for KES 1,999 (14 days) and 50 GB for KES 9,999 (60 days). Each recording can be downloaded or copied to your own storage automatically, which suits a retention schedule you run yourself; the steps are in the Sautikit guide to recording and streaming to S3. For the legal background on that side, read recording calls legally in Kenya.
Start on SautiDesk
- Pick Basic at KES 1,000 per person a month, or Pro at KES 3,000 if supervisors need to listen to live calls and read reports.
- Choose a Kenyan number for KES 500 a month and add your agents.
- Write the notice and put it at the start of your phone menu greeting.
- Write your retention period and your purpose for recording, and share them with the team.
- Top up your balance by M-Pesa or card and take your first recorded call in the browser.
Recordings are available on both plans. The pricing page shows the storage tiers and the rest of the plan.