Kenyan restaurants: DPA 2019, county permit + KRA eTIMS + M-Pesa
The Kenyan restaurant sector (Nairobi, Mombasa, Kisumu, Nakuru, Eldoret, Thika, Nyeri, Machakos, plus coastal tourism belt and lakeside diaspora hubs) operates under six regulatory layers before comparing WhatsApp automation platforms (Wati, Sleekflow, Kommo, BossBot, Callbell, 360dialog, Respond.io) becomes meaningful: (1) Kenya Data Protection Act 2019 (No. 24 of 2019) enforced by the Office of the Data Protection Commissioner (ODPC) — requires registration of data controllers and data processors above threshold turnover (KES 5 million annual turnover), lawful basis and consent for processing, respect for data subject rights (access, correction, erasure, objection, portability), notification of breaches to ODPC within 72 hours, cross-border transfer restrictions requiring adequacy or safeguards; (2) county government business permit — each of Kenya's 47 counties has autonomous business licensing regimes; Nairobi County Single Business Permit (SBP) is the largest by volume, with separate food-handler certificate requirements administered under county public health directorates; (3) national Public Health Act (Cap 242) and Food, Drugs and Chemical Substances Act (Cap 254) — enforced by county public health officers under devolved authority, cover food premises hygiene, food-handler medical certificates, water quality, waste management; (4) Tourism Regulatory Authority (TRA) — restaurants classified as tourist restaurants (particularly in Nairobi CBD, Mombasa coast, Maasai Mara, Naivasha, Nanyuki, Diani) may fall under TRA licensing and star-classification regime; (5) Kenya Revenue Authority (KRA) — VAT standard rate 16%, mandatory eTIMS (electronic Tax Invoice Management System) rollout completed 2024 for VAT-registered businesses with expansion to income tax invoicing, PAYE, WHT and turnover tax obligations, corporate income tax 30% (25% preferential for SMEs meeting definitions); (6) Central Bank of Kenya (CBK) + IPSL (Integrated Payments Service Ltd) — Pesalink real-time interbank transfer scheme, KEPSS (Kenya Electronic Payment and Settlement System) for large-value RTGS, mobile money regulatory framework governing M-Pesa and Airtel Money under Payment Systems Act. Fit by scale: (1) single-owner Nairobi restaurant (25-80 covers per service, 400-800 meals per week, take-away plus dine-in) — WhatsApp Business App (free, up to five linked devices) + M-Pesa Till Number (Paybill or Buy Goods) for payment + county SBP + food-handler certificates for kitchen staff + manual reservation ledger or Google Sheets + KRA-approved eTIMS-compliant invoicing software (many local options including EDMS, TenderBits, PayPlus, Onfon Group, Amanuel), 24 hour turn around expected on ODPC breach notification; (2) mid-size Nairobi restaurant group (2-6 locations, 3000-15000 meals per month including delivery via Glovo, Uber Eats, Bolt Food, Jumia Food) — WhatsApp Business Platform via Business Solution Provider (BSP), multi-user panel (Wati, BossBot, Sleekflow, Kommo, Callbell) with Data Sharing Agreement covering DPA 2019, POS integration (Wallter POS, iSell POS, Yogash, Amanuel, Sage 200 Kenya, TouchOffice, Loyverse), delivery aggregator API integration, M-Pesa Daraja API for automated payments, integration with eTIMS via approved vendor; (3) large Kenyan restaurant chain (Java House with dozens of outlets across East Africa, Artcaffé, Big Square, Chicken Inn, Pizza Hut Kenya, KFC Kenya via TransCentury, Debonairs, Nairobi Street Kitchen) or hotel-restaurant unit inside major hospitality group (Sarova Group, Serena Hotels, Fairmont, Radisson Blu, Villa Rosa Kempinski, DusitD2) — direct Meta BSP + Oracle Hospitality or Toast or Micros POS + dedicated M-Pesa Paybill with high-volume tariff + registered DPO with ODPC + county multi-permit compliance officer + TRA classification maintenance where applicable. Five checkpoints before signing a vendor contract: (1) does the vendor provide an explicit English opt-in workflow with timestamped logging, one-click revocation, and exportable consent register defensible in an ODPC audit? DPA 2019 administrative fines can reach up to KES 5 million or 1% of annual turnover per violation, whichever is higher, with additional criminal liability for wilful violations by officers; (2) does the vendor's Data Sharing Agreement (DSA) or Data Processing Agreement (DPA) explicitly cover Kenya DPA 2019 (including Part VI on transfer of personal data outside Kenya which requires either ODPC adequacy determination, appropriate safeguards, or the data subject's explicit consent), and does the vendor register as a data processor with the ODPC where applicable? (3) does the platform natively integrate M-Pesa (via Daraja API), Airtel Money, Pesalink, and bank cards through Kenyan aggregators (JamboPay, Pesapal, Cellulant, DPO Pay, IntaSend, Kopo Kopo) — or does it force manual pasting of external payment links? M-Pesa alone represents more than 90% of Kenyan retail payment volumes by transaction count. (4) does the generated invoice comply with eTIMS specifications (mandatory for VAT-registered taxpayers since 2024, expanding to non-VAT taxpayers for income tax invoicing) with PIN of buyer where applicable, correct VAT treatment (16% standard or exempt for basic foodstuffs specifically listed), and automatic transmission to KRA? (5) can the data subject customer access their conversation history, request erasure or objection within the reasonable timeframe (DPA 2019 requires response typically within 21 days) without a complex technical process?
Kenyan restaurants face DPA 2019 + ODPC + county licensing + Public Health Act + KRA eTIMS + VAT 16% + M-Pesa Daraja before picking WhatsApp platforms. No shortcuts.
- Kenya Data Protection Act 2019 and what the ODPC expects from a restaurant
- County government business permits and Public Health Act compliance
- KRA, VAT 16%, eTIMS mandatory rollout and the fiscal compliance landscape
- M-Pesa, Airtel Money, Pesalink and the mobile-first payment ecosystem
- Delivery aggregators, marketplace dynamics and the direct-to-consumer WhatsApp channel
- Tourism-classified restaurants, TRA and the coastal/wildlife service model
- Five hard questions to ask the vendor sales rep before signing an annual contract
Kenya Data Protection Act 2019 and what the ODPC expects from a restaurant
The Kenya Data Protection Act 2019 (Act No. 24 of 2019) was assented to by the President on 8 November 2019 and commenced on 25 November 2019, making Kenya one of the more advanced African jurisdictions in adopting comprehensive data protection legislation modelled on the EU GDPR. The Office of the Data Protection Commissioner (ODPC) was operationalised in 2020 with the appointment of the first Data Commissioner, and enforcement activity has intensified progressively. Every Kenyan restaurant — from a small nyama choma spot in Eastlands, to an artisanal coffee shop in Karen, to a fine-dining restaurant in Westlands, to a beach restaurant in Diani — is a data controller within the meaning of the Act if it processes personal data of customers (name, phone, email, dietary preferences, allergies, order history, loyalty programme data, delivery address, payment references). The core obligations include: (a) registration as a data controller or data processor with the ODPC when the annual turnover exceeds KES 5 million or the entity has more than 10 employees; the registration is done through the ODPC online portal and is renewable annually; (b) obtaining a valid lawful basis for processing — consent, contract, legal obligation, vital interests, public interest, or legitimate interests; consent must be freely given, specific, informed, and unambiguous; separate consent required for direct marketing and for sharing with third parties; (c) respecting data subject rights: access to personal data held (with response within reasonable time, typically 21 days), correction of inaccurate data, erasure or destruction, objection to processing including marketing, portability of data in machine-readable format; (d) implementing appropriate technical and organisational security measures — the ODPC has issued sector-specific guidance; (e) restrictions on cross-border transfers under Part VI of the Act — transfer outside Kenya requires either an ODPC adequacy determination for the destination country, appropriate safeguards (binding corporate rules, standard contractual clauses approved by the ODPC), or the explicit consent of the data subject after being informed of the risks; (f) notifying the ODPC and affected data subjects within 72 hours of a personal data breach that is likely to result in risk to the rights and freedoms of natural persons; (g) appointing a Data Protection Officer (DPO) in certain circumstances (public bodies, entities engaged in systematic monitoring of data subjects, entities processing sensitive personal data at scale). Administrative fines under Section 63 can reach up to KES 5 million or 1% of the entity's annual turnover, whichever is higher, per violation. Criminal penalties under Section 72 can apply to wilful violations. The ODPC has been active in issuing enforcement decisions, including against restaurant sector operators, mobile lending platforms, real estate agencies, and telecommunications providers — a restaurant that sends bulk WhatsApp promotional messages to customer numbers collected during in-store orders without documented specific marketing consent is exposed to complaint and administrative action.
County government business permits and Public Health Act compliance
Kenya's Constitution 2010 devolved significant public administration functions to county governments — 47 counties operate autonomous business licensing, land use planning, and public health administration regimes under the Fourth Schedule. Every restaurant must hold a Single Business Permit (SBP) issued by the county in which it operates, valid for a calendar year and renewed annually. Nairobi County SBP is the highest-volume regime, with fee schedules calibrated by business type, seating capacity, and location (CBD, sub-county). Mombasa County, Kisumu County, Nakuru County, and other urban counties have equivalent regimes with local variations. Beyond the SBP, restaurants require additional certifications: (a) food-handler medical certificate for each kitchen staff member — annual medical examination by a designated public health facility confirming absence of typhoid, tuberculosis, and other communicable diseases; (b) fire safety certificate from the county fire department or from the National Construction Authority for larger premises; (c) waste disposal registration with the county environmental department; (d) music and entertainment licensing where applicable (from the Music Copyright Society of Kenya MCSK, Kenya Association of Music Producers KAMP, Performing Rights Society of Kenya PRISK, and county entertainment licensing for live music). The Public Health Act (Cap 242) and the Food, Drugs and Chemical Substances Act (Cap 254) provide the national framework for food premises hygiene, food safety, and consumer protection; enforcement is largely devolved to county public health officers who conduct routine and complaint-driven inspections. Restaurants in coastal areas serving tourists may fall under Tourism Regulatory Authority (TRA) classification and require additional TRA licensing and star classification — this creates cross-cutting compliance requirements. Non-compliance can trigger warnings, on-the-spot fines (bribery risk is a persistent concern that responsible operators should not accommodate — official penalties are payable through KRA integrated payment systems), temporary closure, or in severe cases prosecution. WhatsApp customer communications intersect with these regulations when marketing messages reference food safety credentials ("KEBS certified kitchen", "HACCP compliant") that must be genuinely held and current.
KRA, VAT 16%, eTIMS mandatory rollout and the fiscal compliance landscape
The Kenya Revenue Authority (KRA) administers all national taxes. VAT is levied at the standard rate of 16% on the supply of goods and services, with zero-rating for exports and specific listed items, and exemptions for basic foodstuffs (unprocessed cereals, fresh vegetables, fresh fruit) and specific health, education, and financial services. Restaurant services (dine-in, take-away, delivery, catering) are generally VAT-able at 16%. Corporate income tax is 30% for resident companies (25% preferential rate for qualifying SMEs meeting specific criteria). Individual income tax for restaurant owners operating as sole proprietors or partnerships is calculated on graduated rates. The Turnover Tax (ToT) regime at 3% applies to small businesses with annual turnover between KES 1 million and KES 25 million that opt in (mutually exclusive with VAT registration and standard income tax). eTIMS (electronic Tax Invoice Management System) is the KRA mandatory electronic invoicing regime that completed rollout for VAT-registered taxpayers in 2024 and is expanding to non-VAT taxpayers for income tax invoicing purposes. Every VAT-registered restaurant must issue tax invoices through eTIMS-approved software or the KRA eTIMS mobile application; each invoice generates a QR code, an eTIMS control code, and is transmitted in near-real-time to the KRA. Approved eTIMS vendors include a growing list of software providers — Onfon Group, EDMS, TenderBits, PayPlus, Amanuel, Sage Kenya, PesaBase, Kopo Kopo Business, JamboPay, and others. A restaurant that fails to issue eTIMS-compliant invoices exposes itself to VAT input credit denial for its B2B customers, KRA compliance penalties, and business permit renewal complications (KRA compliance certificate is often a prerequisite for county SBP renewal). PAYE for restaurant employees, NHIF and NSSF contributions, WHT on rent and professional services, and withholding VAT on payments to unregistered suppliers add layers of routine compliance that responsible operators manage through payroll software (Sage, iTax integrations) and accountants. WhatsApp automation platforms marketing to Kenyan restaurants should support integration with eTIMS-approved invoicing vendors, allowing WhatsApp-received orders to automatically generate KRA-compliant invoices upon payment confirmation. Attempting to bypass eTIMS by issuing informal receipts through the WhatsApp channel is not a viable strategy — the regulatory posture is progressively tightening.
M-Pesa, Airtel Money, Pesalink and the mobile-first payment ecosystem
Kenya is the birthplace of mobile money and remains the global reference market for mobile money adoption. M-Pesa (Safaricom, launched 2007) dominates with a share consistently reported above 90% of Kenyan mobile money transactions; Airtel Money (Airtel Africa) and T-Kash (Telkom Kenya) compete in smaller shares. Central Bank of Kenya (CBK) regulates mobile money as electronic money issuance under the National Payment System Act 2011 and subsequent regulations. Pesalink is the real-time interbank transfer scheme operated by Integrated Payments Service Ltd (IPSL, jointly owned by Kenyan banks) enabling account-to-account transfers between participating banks in seconds; KEPSS (Kenya Electronic Payment and Settlement System) handles large-value RTGS transactions. For a restaurant, the practical payment collection options include: (a) M-Pesa Till Number (Buy Goods, for merchant payments where the payer only needs to enter the Till Number and amount) or M-Pesa Paybill Number (account number required, useful for delivery orders where order reference becomes the account) — the tariff structure for Buy Goods is that the merchant absorbs a small percentage per transaction, currently in the range of 0.5-1% depending on the tier, while for Paybill the customer pays the M-Pesa withdrawal tariff, which changes the perceived cost; (b) direct integration with M-Pesa via the Safaricom Daraja API for automated STK Push (the payer receives a mobile prompt to authorise payment) or C2B/B2C transactions — enables programmatic reconciliation directly with the restaurant's point-of-sale or WhatsApp automation platform; (c) Airtel Money and T-Kash for the segments preferring those wallets; (d) card acceptance via Kenswitch, Visa/Mastercard through KCB Bank, Equity Bank, Standard Chartered, Absa Kenya, DTB, Cooperative Bank, or through aggregators (JamboPay, Pesapal, DPO Pay, Cellulant, IntaSend, Kopo Kopo, PesaSwitch); (e) Pesalink for larger direct transfers when customer prefers bank-to-bank. A WhatsApp automation platform integrated with the Safaricom Daraja API can generate an STK Push request from within the conversation flow — the customer confirms payment on their phone, the restaurant receives an automated payment confirmation and updates the order status without manual reconciliation. This capability is a decisive competitive differentiator in the Kenyan market: platforms that only offer Stripe/PayPal (both usable in Kenya but with a marginal share of retail transactions) provide inferior conversion. Delivery aggregators (Uber Eats, Bolt Food, Glovo, Jumia Food) handle payment collection internally and remit net of commission (typically 25-35% of order value plus fees) to the restaurant — this eliminates payment complexity for the delivery channel but transfers a substantial margin to the aggregator.
Delivery aggregators, marketplace dynamics and the direct-to-consumer WhatsApp channel
The Kenyan food delivery market is dominated by four international platforms and one regional player: Uber Eats (US, present since 2018), Bolt Food (Estonia, aggressive expansion since 2020), Glovo (Spain, strong Nairobi and Mombasa presence), Jumia Food (Africa-focused platform now integrated with Jumia's broader marketplace strategy), and specific local operators serving niche needs. Aggregator commissions typically fall in the 25-35% range of gross order value, plus customer-side delivery fees. For many Nairobi restaurants, delivery aggregators represent 15-40% of revenue but with margin compressed to slim single digits after cost of goods, labour, and utilities. The alternative that many operators pursue is a direct WhatsApp order channel: the customer messages the restaurant, receives a menu (PDF, image, or catalogue link), places the order, the restaurant generates an M-Pesa STK Push for payment via Daraja API, and the restaurant handles delivery either through in-house riders or through a logistics partner (Sendy for last-mile logistics, Twiga Foods for produce restaurant supply, various boda-boda partners for restaurant delivery within neighbourhoods). This direct channel eliminates the aggregator commission and preserves the customer relationship (aggregators typically restrict restaurant access to customer contact data), but adds operational complexity — the restaurant must manage inbound WhatsApp volume, delivery coordination, driver reliability, and customer service. A WhatsApp automation platform is the leverage that makes the direct channel feasible at scale: automated menu presentation, automated payment link generation, automated order confirmation and preparation status updates, automated driver assignment and tracking. The tension between direct channel margin capture and aggregator channel reach is not either-or but strategic mix — most established Nairobi restaurants operate on aggregators for visibility while cultivating a WhatsApp regulars channel for lower-cost repeat orders. Loyalty programmes that reward direct WhatsApp orders (discount on fifth order, free coffee on birthday) can shift the balance progressively without shocking customers accustomed to aggregator convenience. Data protection compliance applies fully in the direct channel — the restaurant collects and stores customer data directly and must adhere to DPA 2019, whereas in the aggregator channel the aggregator is (arguably) the data controller for the customer relationship with the restaurant acting more like data processor for order fulfilment.
Tourism-classified restaurants, TRA and the coastal/wildlife service model
Kenya's tourism industry is a substantial contributor to national GDP and to restaurant sector revenue in specific geographies — Nairobi CBD (business travellers and safari transit), Mombasa coastal strip (Diani, Watamu, Malindi, Lamu), Maasai Mara and Serengeti-adjacent lodges (Naboisho, Ol Kinyei, Enonkishu conservancies), Amboseli, Tsavo, Samburu, Laikipia (Nanyuki, Nyahururu), Naivasha and Nakuru lakes region, coastal cruise stops. Restaurants classified as tourist restaurants may fall under Tourism Regulatory Authority (TRA) jurisdiction, established under the Tourism Act 2011. TRA licensing and star-classification (equivalent to hospitality star classification) impose additional requirements around service standards, staff training, safety and hygiene, and reporting. Tourism operators frequently rely on WhatsApp to communicate with guests (booking confirmation, transfer coordination, dietary preference collection, menu availability updates for remote lodges with limited connectivity). The seasonality of tourism (peak December-February and July-October, low April-May for coast; low January-February and high June-October for safari regions) creates specific automation needs — pre-arrival dietary and allergy questionnaires, arrival day welcome messages, post-visit review requests. Multi-language support becomes practically important: guest arrivals from Germany, UK, US, France, Netherlands, Italy, China, and increasingly India create demand for automated communication in multiple languages. A WhatsApp automation platform serving tourism-classified restaurants must handle Swahili and English as baseline, ideally with additional European and Asian language options either through native templates or through integration with translation services (with awareness of translation accuracy limitations for guest safety information). Data protection extends across borders: an EU guest whose data is processed by a Kenyan tourist restaurant may invoke GDPR rights against the restaurant to the extent the restaurant offers goods and services to EU data subjects — the interplay between DPA 2019 (Kenya) and GDPR (EU) requires the restaurant DPO to be reasonably familiar with both frameworks.
Five hard questions to ask the vendor sales rep before signing an annual contract
Before a Kenyan restaurant owner or the operations director of a Kenyan restaurant group signs an annual subscription with a WhatsApp automation platform, five written questions should be put to the sales representative with a demand for documented replies (dated emails with attachments, contract extracts, feature screen captures): (1) does the consent capture workflow comply with DPA 2019, in English with option for Swahili, with timestamped logging, one-click revocation, and exportable consent register defensible in an ODPC audit? Marketing consent must be separate from service consent, per ODPC guidance. (2) does the contractual Data Sharing Agreement or Data Processing Agreement explicitly cover DPA 2019 (particularly Part VI on cross-border data transfers requiring ODPC adequacy or explicit consent), specify data hosting location (Kenyan hosting through Safaricom Kenya cloud or Africa Data Centres are premium options; EU or US hosting requires transfer justification), and identify a designated representative reachable in East African Time zone? (3) does the platform natively integrate M-Pesa via the Safaricom Daraja API (STK Push for payment initiation, C2B webhook for confirmation), plus Airtel Money, Pesalink, and cards through JamboPay, Pesapal, DPO Pay, Cellulant, IntaSend or Kopo Kopo — or does it force the restaurant to manually paste external payment links? M-Pesa integration is not optional in the Kenyan market. (4) does the platform integrate with KRA eTIMS-approved invoicing vendors (Onfon Group, EDMS, TenderBits, PayPlus, Amanuel, Sage Kenya) so that every WhatsApp-received order automatically generates a KRA-compliant tax invoice upon payment, with QR code and eTIMS control code, transmitted to KRA in near real-time? (5) is the pricing invoiced in Kenya shillings (KES) with VAT 16% recoverable, or in USD with imported services complications (reverse-charge VAT applies under KRA rules), and does the vendor have a Kenyan reseller or invoicing entity to simplify local compliance? If replies are evasive or negative on multiple points, the vendor has not yet matured for the Kenyan market despite a potentially polished sales demo. A restaurant paying KES 5,000 to KES 50,000 per month for automation expects operational returns and regulatory cover appropriate to the ODPC, KRA, county government, and Public Health Act framework.
Sources
Data + numbers referenced in this article are sourced from these public documents:
Frequently Asked Questions
BossBot for Restaurants & Cafés
Product page with honest feature list, "not for you if" filter, and live demo for this vertical.
See /for/restaurant →Stop Losing KES to Missed Messages!
Ready to transform your restaurant's customer service and boost your bottom line? Discover how BossBot can automate your WhatsApp interactions, recover lost revenue, and delight your customers.
Not ready to sign up yet? Try the free demo →