CCTV Cameras

CCTV Installation in Kenya: Costs, Camera Types & Data Protection Act Compliance

CCTV has gone from a luxury to a near-default expectation for homes, shops, offices, and compound security across Kenya. But installing cameras isn’t purely a technical decision — since 2019, it’s also a legal one. This guide covers what a CCTV system actually involves, realistic Nairobi-area pricing, and the Data Protection Act rules that catch out more installers and business owners than most people expect.

What is a CCTV system, in practical terms

A CCTV (Closed-Circuit Television) system captures video to a private, limited set of screens or storage devices rather than broadcasting publicly. A standard installation has five core components: cameras, a recording unit (DVR for analogue systems, NVR for IP/network cameras), storage (hard drives), cabling, and a viewing setup (monitor and/or mobile app).

Types of cameras used in Kenya

• Dome cameras — discreet, vandal-resistant, common in shops, offices, and lobbies
• Bullet cameras — visible, cylindrical, used outdoors partly because their visibility acts as a deterrent
• PTZ (pan-tilt-zoom) cameras — for wide-area coverage in malls and parking areas
• Infrared/night-vision cameras — for reliable 24-hour monitoring in low light
• IP cameras — network-connected, support remote viewing via phone or web
• Wireless cameras — easier to install, but dependent on a strong local connection
• Solar-powered CCTV — increasingly used where grid electricity is unreliable, useful for gates, farms, and compounds in areas with patchy power

Hikvision, Dahua, and Ezviz are the brands most commonly stocked and recommended by Kenyan installers, largely on reliability, local support availability, and price point.

What does CCTV installation cost in Kenya?

Realistic Nairobi-area pricing generally falls into these bands:

• Basic home camera kits — from around KSh 15,000 for an entry-level analogue setup
• Standard home installation (around 4 cameras) — roughly KSh 25,000–40,000, covering cameras, DVR/NVR, cabling, and installation
• Small business installation (around 8 cameras) — roughly KSh 50,000–80,000
• IP camera systems — typically from KSh 30,000+, reflecting the higher resolution and network features versus analogue
• Enterprise-scale systems — KSh 150,000+, depending on camera count, coverage area, and storage requirements

Storage guidance: most installers recommend 500GB–1TB for home use (roughly 1–2 weeks of retained footage) and 2–4TB for a business wanting about a month of storage — actual requirements depend on camera count and resolution.

The legal side: the Data Protection Act, 2019

This is the part many CCTV buyers and even some installers overlook. Under Kenya’s Data Protection Act, 2019 (DPA), footage that can identify a person counts as personal data — and once you’re capturing images of people, you’re legally a data controller (or processor) under the Act, with real obligations attached.

Registration requirement. Businesses with an annual turnover of KES 5 million or more, or more than 10 employees, that use CCTV are required to register with the Office of the Data Protection Commissioner (ODPC) as a data controller or processor. Separately, where CCTV is used specifically for crime prevention or security purposes — which covers most commercial installations — registration is mandatory regardless of company size or turnover, under the 2021 registration regulations.

Core compliance obligations:

• Transparency — you must display visible signage informing people that CCTV is in operation, ideally naming the company (as data controller), the purpose of the surveillance, and how to obtain further information (e.g., via a QR code or contact details).
• Lawful purpose — you need a specific, legitimate reason for the surveillance (security, crime prevention) rather than open-ended monitoring.
• Data Protection Impact Assessment (DPIA) — required when CCTV monitors a publicly accessible area, and again whenever cameras are relocated, or the system is reconfigured.
• Data subject rights — people have the right to request access to footage involving them, and you need a process to respond to such requests within statutory timelines.
• Responsible footage handling — recordings can’t be shared publicly or repurposed beyond the original stated purpose (e.g., you can’t commercialise security footage) without a separate lawful basis.

Penalties. DPA violations can attract fines of up to KES 5,000,000, or 1% of the company’s annual turnover from the preceding financial year, whichever is lower. Separately, unlawfully disclosing personal data captured on CCTV outside its original purpose can carry criminal exposure, with fines reported as high as KES 3,000,000 in commentary on the Act.

The household exemption. If your CCTV covers only your own private property — your own home and garden, for instance — and not neighbours or public areas, this generally falls under the Act’s personal/household activity exemption, and most DPA obligations don’t apply. This distinction has been tested in Kenyan courts: in one case, the High Court ordered a homeowner to uninstall CCTV cameras after finding they captured a neighbor’s property without consent, ruling this violated the neighbour’s constitutional privacy rights and the DPA — a useful cautionary example when siting cameras near a boundary.

How installation actually proceeds

1. Site survey — identifying entry points, key coverage areas, and lighting conditions (day/night performance requirements).
2. System design — choosing camera types (dome/bullet/PTZ), resolution, and analogue vs. IP based on the site and budget.
3. Wiring and mounting — running cables, positioning cameras, and installing the power supply (including solar options where relevant).
4. DVR/NVR configuration — connecting the recording unit and setting retention/storage parameters.
5. Remote access setup — configuring mobile or web viewing where required.
6. Compliance step — installing signage and, for commercial clients, confirming ODPC registration status and, where the system monitors public areas, completing a DPIA.

Frequently asked questions

Do I need a licence to install CCTV in Kenya? No specific licence is required for private/personal use. Businesses using CCTV for security purposes, however, are generally required to register with the ODPC as a data controller or processor, and must comply with DPA obligations around signage, purpose, and data subject rights.

Can I install CCTV covering the street outside my property? This moves you out of the personal/household exemption and into full DPA obligations, since you’re now monitoring a publicly accessible area — a DPIA and registration considerations apply.

How long should I keep footage? There’s no single fixed legal retention period, but storage should be proportionate to your stated purpose; most home users keep 1–2 weeks, businesses often keep around a month, based on typical storage sizing (500GB–1TB home, 2–4TB business).

Do CCTV systems need internet to work? No — cameras can record locally to a DVR/NVR without any internet connection. Internet is only required for remote viewing via phone or web.

What happens if I share footage without a lawful reason? Disclosing footage in a way that goes beyond its original stated purpose (e.g., posting security footage publicly, or using it commercially) can expose you to DPA penalties and civil liability, separate from the registration requirement itself.