How to Run a Legal Background Check in Kenya

A background check is legal in Kenya when it follows the Data Protection Act 2019: the candidate knows what you will check and why, agrees before anything starts, and their data is used only for that purpose. This guide walks through the process step by step.

1. Decide which checks the role actually needs

The Act requires personal data to be adequate, relevant and limited to what is necessary. Match the checks to the role:

• Every hire: identity and KRA PIN, so payroll and statutory filings are correct.
• Roles that rely on qualifications: education and professional certificates.
• Senior or trusted roles: previous employment and references.
• Roles with access to cash, keys, children or sensitive data: a criminal record check.

Write the list down per role, so every candidate for the same job is treated the same way.

2. Tell the candidate and get consent first

Before any check starts, tell the candidate in writing:

• which checks you will run and why each one is needed,
• who will carry them out (you, or a provider acting for you),
• how long you will keep the results, and
• their right to see, correct or ask you to delete their data.

Then get their consent. Under the Act, consent must be express, unequivocal, freely given, specific and informed, so a signed form that lists each check is the clearest record. Do not start a check because a candidate "didn't object".

3. Collect only the documents each check needs

Ask for the documents each check needs and nothing more: for example, a copy of the national ID for identity, certificates for education, and the candidate's own Certificate of Good Conduct (police clearance) from the DCI for a criminal record check. The candidate applies on eCitizen for KES 1,050, presents the C24 form for fingerprinting at a Huduma Centre or DCI office, and downloads the certificate from eCitizen once it is ready. Processing takes anywhere from a few days to several weeks, and employers commonly accept certificates up to a year old. Store them securely and limit who on your team can open them.

4. Verify against the source

A check is only as good as its source:

• Identity: the national registration records (IPRS).
• KRA PIN: KRA's records (see how to verify a KRA PIN).
• Education: the issuing institution or examining body.
• Employment: the previous employer's HR team, not just a referee's mobile number.
• References: structured questions, sent to the referees the candidate named.

5. Let the candidate explain discrepancies

If a finding does not match what the candidate told you, let them explain before you decide. Records are sometimes wrong, and the Act gives candidates the right to have inaccurate data corrected.

6. Keep results secure, then delete them

Keep results only as long as you need them for the decision and any legal obligation that follows, then delete or anonymise them. Most organisations that process personal data must also register with the ODPC as a data controller or data processor, unless they fall under an exemption in the registration regulations - check the ODPC's registration guidance for whether yours must.

How Cazini handles this

On Cazini you choose the checks for a candidate and Cazini emails them a consent request. The candidate signs and uploads the documents each check needs in a secure portal, and no check starts before they consent. Each finding is verified against its source and reviewed before you see it, and the results arrive as one report.

Available checks: identity (IPRS), KRA PIN, education, employment history, criminal record and professional references. See background checks for turnaround times, or read how we protect candidate data on the trust page.

Sources

• Data Protection Act, 2019 (Kenya Law) - consent, data minimisation and, in section 63, administrative fines of up to KES 5 million or 1% of annual turnover, whichever is lower
• Office of the Data Protection Commissioner
• eCitizen - DCI Certificate of Good Conduct applications

Frequently asked questions

Is it legal to run a background check on a job candidate in Kenya?+

Yes, provided you follow the Data Protection Act 2019. Tell the candidate what you will check and why, get their consent before you start, collect only what the role needs, and keep the results secure.

Do I need written consent for a background check?+

The Data Protection Act requires consent that is express, unequivocal, freely given, specific and informed. A signed consent form that lists each check is the clearest way to show you obtained it.

What checks can an employer run in Kenya?+

Common checks are identity against the national registration records (IPRS), KRA PIN, education, previous employment, criminal record and professional references. Run only the checks that are relevant to the role.

How long should I keep background check results?+

Only as long as you need them for the hiring decision and any legal obligation that follows. Delete or anonymise them after that, and tell candidates how long you keep their data.

What happens if an employer breaks the Data Protection Act?+

The Office of the Data Protection Commissioner can investigate complaints, order corrective action and impose administrative fines of up to KES 5 million or 1% of annual turnover, whichever is lower.