As hybrid work becomes the norm, Kenyan employers face new obligations on working hours, health and safety, and data privacy. We outline the legal essentials.
Remote and hybrid work arrangements have moved from emergency accommodation to standard business practice across Kenya's private sector. Yet a significant number of employers have not updated their employment contracts, workplace policies, or HR frameworks to reflect the legal obligations that apply just as much to an employee working from a home office in Nakuru as to one seated at a desk in the firm's Westlands branch.
This article outlines the key legal requirements under the Employment Act 2007 (Cap. 226), the Occupational Safety and Health Act (OSHA) 2007, the Data Protection Act 2019, and Employment and Labour Relations Court (ELRC) jurisprudence that every Kenyan employer with remote workers must address.
1. Written Employment Contracts: The Basics Still Apply
Section 10 of the Employment Act 2007 requires every employer to supply an employee with a written statement of the particulars of their employment within two months of commencement. This requirement does not disappear because the employee works remotely. In fact, for remote workers, the written contract becomes even more important because it defines the physical workspace, equipment responsibilities, and availability expectations that would ordinarily be implied by attendance at a fixed office.
- Specify the employee's designated work location (home address, co-working space, or "remote") and whether this can be changed unilaterally by the employer
- Define working hours, including core hours for hybrid workers, and confirm whether overtime provisions apply
- Clarify ownership of equipment provided by the employer and the employee's obligations to safeguard it
- State the employer's right to monitor the employee's work output and use of company IT systems
- Include an express data protection clause covering the handling of personal data on personal devices and home networks
2. Working Hours, Rest, and Overtime
Section 27 of the Employment Act caps the standard working week at 52 hours (excluding agricultural workers). For remote workers, the boundary between working time and personal time is inherently blurred. Employers who expect remote workers to be available outside contractual hours — responding to messages, attending video calls, or completing tasks — without additional compensation risk claims for unpaid overtime under Section 27(2).
Kenya does not yet have a statutory "right to disconnect" law equivalent to those enacted in France or Ireland, but ELRC decisions increasingly scrutinise employer expectations of out-of-hours availability. A clear written policy defining response-time expectations during and outside working hours is both a legal safeguard and a tool for managing employee wellbeing.
Public Holidays and Leave for Remote Workers
Remote workers are entitled to all statutory public holidays and annual leave entitlements on the same basis as office-based employees. Employers must not impliedly waive these entitlements by creating a working culture in which remote employees are expected to be available on public holidays without express agreement and additional compensation.
3. Occupational Safety and Health: The Employer's Duty Extends to the Home
Section 6 of OSHA 2007 imposes a general duty on every employer to ensure, so far as is reasonably practicable, the safety, health, and welfare at work of all persons employed. The Directorate of Occupational Safety and Health Services (DOSHS) has confirmed that this duty extends to remote workplaces — including the employee's home — to the extent that the employer has the ability to influence working conditions.
In practice, this requires employers to carry out a remote work risk assessment, provide guidance on setting up an ergonomically safe workstation, and address psychosocial risks including isolation and overwork. Employers who have never conducted a remote work health and safety review should do so urgently, particularly given the increasing focus by DOSHS inspectors on work-from-home arrangements.
- Issue a remote workstation self-assessment checklist to all home-based employees
- Provide or reimburse reasonable ergonomic equipment (chair, monitor stand, keyboard) for long-term remote workers
- Ensure the organisation's Employee Assistance Programme (EAP), if any, covers remote-worker mental health support
- Update the company's WIBA (Work Injury Benefits Act) notification procedures to capture incidents occurring in the home workspace
- Conduct periodic welfare check-ins for employees working fully remotely without regular in-person contact
4. Data Privacy and the Data Protection Act 2019
The Data Protection Act 2019 (DPA) and the Data Protection (General) Regulations 2021 place obligations on data controllers and processors with respect to the security of personal data. Where employees access, process, or store personal data from home — using personal devices, home Wi-Fi networks, or cloud services — the employer remains the data controller and is responsible for implementing appropriate technical and organisational measures to secure that data.
Failure to implement adequate security measures for remote data processing can attract enforcement action by the Office of the Data Protection Commissioner (ODPC), including fines of up to KES 5 million or three times the value of any transaction arising from the violation.
- Implement a mandatory VPN policy for employees accessing company systems remotely
- Prohibit processing of sensitive personal data on personal (BYOD) devices without encryption and remote-wipe capability
- Update the company's Data Protection Policy and Privacy Notice to describe remote processing arrangements
- Ensure all remote workers receive data protection training at onboarding and annually thereafter
- Review third-party cloud service agreements to confirm they meet the DPA's data processor requirements
Recommended Contract Clauses for Remote Workers
Employers should ensure that employment contracts for remote or hybrid workers include, at minimum, the following express provisions:
- A remote work clause defining the approved work location and the procedure for changing it
- A technology and equipment clause allocating responsibility for providing, insuring, and maintaining equipment
- A monitoring and performance management clause confirming the employer's right to monitor output (not necessarily surveillance) and the performance review framework
- An expenses clause addressing reimbursement of internet, telephone, and utilities costs attributable to remote work
- A data security clause requiring the employee to comply with the company's IT security policies at all times
- An availability and response-time clause setting out core hours and maximum expected response times outside those hours
Collins Ochola Advocates assists employers across Kenya with drafting and reviewing employment contracts, remote work policies, and data protection frameworks tailored to their specific workforce and industry. Contact us today for a confidential employment law audit.