Legal and compliance

Tax has KRA and a deadline that forces the issue. Legal risk in a small business is quieter, nothing enforces a written contract or a registered trademark on a schedule, so it is the exact category of risk that gets ignored until a dispute or a copycat forces the question. None of what follows is complicated. It is just never explained.

A written contract is cheaper than the dispute it prevents

Most small business disagreements in Kenya, a client refusing to pay, a supplier changing terms, an employee dispute, trace back to something that was agreed verbally and never written down. A contract does not need to be long or written by a lawyer to be useful. At minimum, put in writing: what is being delivered, by when, for how much, and what happens if either side does not hold up their end. A one-page agreement both sides sign is worth more than a detailed verbal understanding neither side can prove.

Data protection applies to more businesses than expect it to

If your business collects customer information, names, phone numbers, ID numbers, payment details, even in a simple spreadsheet or a point-of-sale system, the Data Protection Act 2019 likely applies to you. Businesses with an annual turnover under KES 5,000,000 and 50 employees or fewer are generally exempt from registering with the Office of the Data Protection Commissioner (ODPC), but only if you meet both conditions, not just one. Above either threshold, registration as a data controller or processor is required before you process personal data, done electronically through the ODPC. Penalties for non-compliance run up to KES 5,000,000 or 1% of annual turnover for data controllers, whichever is higher, so this is not a theoretical risk once a business has scaled past the exemption.

The practical version, regardless of whether registration applies to you: do not collect customer data you do not need, keep what you do collect reasonably secure, and never share a customer’s personal information with a third party without their knowledge.

Protecting your name and your work

A business name registered with BRS is not the same as a trademark, and confusing the two is a common and expensive mistake. Registering the business name stops someone else from registering that exact name at BRS. It does not stop a competitor from using a similar logo, slogan, or brand identity in the market. A trademark, registered through KIPI (the Kenya Industrial Property Institute), is what actually protects your brand identity. A straightforward trademark registration typically costs in the range of KES 25,000-40,000 all-in (the KIPI application and search fees plus a professional fee if you use an agent), and is worth doing once a brand has real value worth defending, not necessarily on day one.

Employment contracts are a legal requirement, not a courtesy

Kenya’s Employment Act sets out requirements around written particulars of employment for people you employ regularly, not just a best practice. This overlaps with the hiring guidance in Running and scaling, the point here is narrower: the paperwork itself is a legal compliance matter, and getting it wrong is a common source of costly disputes at the point an employee leaves, is let go, or is injured at work. A simple, correctly structured contract, checked once by someone qualified, is cheap insurance against a dispute that is not.

Importing goods brings its own rules

If your business imports anything, stock, equipment, raw materials, import duty and the correct customs classification apply, and getting the classification wrong is a common way businesses either overpay or end up with a compliance problem at the border. This is a specialist area worth a customs agent’s input the first few times, not something to guess at from a general guide.