Career advice · Updated November 2026

Reference and Background Checks in Kenya: What Employers Can Lawfully Do

Reference checks in Kenya are lawful when the employer treats them as processing of personal data under the Data Protection Act, 2019: tell the candidate what you will check and why, collect only what is relevant to the job, get consent or another lawful basis before you contact third parties, keep the notes secure and delete them when they are no longer needed. A background check is not a licence to dig into a candidate’s family, health or private life. This guide sets out a practical process for small employers and HR teams, with the sections of the law behind each step.

Based on the Data Protection Act, 2019 (No. 24 of 2019) as published, and the Employment Act, 2007, reviewed on 7 November 2026. This is general guidance, not legal advice; take advice on unusual cases.

Why the Data Protection Act applies to hiring

When you collect a CV, call a referee or ask for a police clearance certificate, you are collecting and processing personal data, and your organisation is the data controller. Section 25 of the Act requires that personal data is processed lawfully, fairly and transparently, collected for explicit and legitimate purposes, and is “adequate, relevant, limited to what is necessary” for those purposes. It also says information about family or private affairs should be collected only where a valid explanation is given.

For recruiters, that translates into a simple test: would a reasonable candidate expect this check for this role, and do you actually need the answer to decide?

Step 1: Tell candidates before you check

Section 29 places a duty on the data controller to inform people, as far as practicable and before collecting data, about the purpose of collection, the fact that data is being collected, their rights, who else may receive it and the consequences of not providing it. In hiring, the easiest way to meet this is a short privacy notice in the advert or application form, repeated when you move someone to the reference stage. Our job advert checklist shows where such a note can sit.

A workable notice says which checks you run for this role (for example, two employment references, verification of academic certificates and a certificate of good conduct), who will see the results, how long you keep them and whom to contact with questions.

Step 2: Get consent or rely on another lawful basis

Section 30 lists the lawful grounds for processing. Consent for a specified purpose is one; others include steps taken at the request of the data subject before entering into a contract, and compliance with a legal obligation. Section 28 adds that personal data should normally be collected directly from the person, with listed exceptions, including where the person has consented to collection from another source.

Because a reference call collects data from someone other than the candidate, the cleanest approach is written consent naming the referees or institutions you will contact. Section 32 places the burden of proving consent on the data controller and allows a person to withdraw consent, so keep a record of what was signed and when.

Step 3: Ask only job-related questions

Keep the reference script focused on facts and performance that matter for the role:

• Confirmation of job title, dates of employment and main duties.
• Examples of work quality, reliability and specific skills the role needs.
• Whether the referee would rehire, if the referee is willing to say.

Avoid questions about marital status, children, ethnic origin, religion, health or sexual orientation. The Act defines these as sensitive personal data, and Section 44 restricts how such data may be processed. If a role genuinely needs a medical assessment, handle it as a separate, documented process rather than a casual question to a former boss.

Step 4: Verify documents at the source

Many checks are verification rather than opinion. Confirm academic certificates with the issuing institution or the relevant examining body, check professional registrations with the regulator’s public register, and ask the candidate to obtain any clearance certificates the role requires. Our clearance certificates guide lists where each certificate comes from. Data contained in a public record can be collected indirectly under Section 28, but you still need a purpose that is lawful and explicitly defined.

What former employers can and cannot be asked to give

Under Section 51 of the Employment Act, an employee whose employment lasted at least four consecutive weeks is entitled to a certificate of service setting out the employer’s name and postal address, the employee’s name, the dates employment began and ended, and the nature and usual place of employment. Section 51(3) says no employer is bound to give a testimonial, reference or certificate relating to the employee’s character or performance. In practice, that means a former employer may decline to give a reference, and a refusal is not, on its own, evidence against the candidate. Read more in our certificate of service guide.

Step 5: Record, store and delete

Write down what each referee said, the date, and who made the call. Store notes with the same care as payroll records: limited access, password protection and no sharing on informal chat groups. Section 26 gives the candidate rights to be informed, to access their data, to object, and to have false or misleading data corrected or deleted, so notes should be factual and defensible.

The Act’s principles require data to be kept no longer than necessary for the purpose it was collected. Set a retention period in your policy, for example a few months after the hiring decision for unsuccessful candidates, and delete on schedule. For the person you hire, move only what is needed into the personnel file.

Handling a negative or conflicting reference

One poor reference should prompt a question, not an automatic rejection. Give the candidate a chance to respond, check whether the referee had a direct working relationship with them, and weigh the comment against your interview scorecard evidence. Record why you made the final decision. If you discover a false certificate or a misrepresented qualification, act on the verified fact and keep the evidence.

A short reference-check checklist

1. Privacy notice in the advert or application form.
2. Signed consent naming referees and verification bodies.
3. A written script of job-related questions, applied to every shortlisted candidate for the role.
4. Documents verified at the issuing institution or regulator.
5. Notes stored securely, with a set deletion date.
6. A clear decision record, including how any conflicting reference was weighed.

Fair, consistent checks protect you as well as the candidate. Pair this process with a lawful probation period and a clear written contract. When you are ready to recruit, post your vacancy on JobInKenya.

Frequently asked questions

Do I need a candidate's consent before calling referees?

The Data Protection Act requires a lawful basis and normally expects data to be collected directly from the person. Written consent naming the referees is the clearest way to collect information from them.

Must a former employer give a reference in Kenya?

No. Section 51(3) of the Employment Act says an employer is not bound to give a testimonial or reference on character or performance, but it must issue a certificate of service.

Can I ask a referee about a candidate's health or family?

Avoid it. Health, family details, marital status, ethnic origin, religion and sexual orientation are sensitive personal data under the Act, and processing them is restricted.

How long should I keep reference-check notes?

Only as long as necessary for the hiring purpose. Set a retention period in your policy and delete records for unsuccessful candidates on schedule.