The 2026 HR compliance checklist every Kenyan employer needs

Most employment disputes in Kenya are lost long before a tribunal hears them — in missing contracts, undated policy manuals and statutory deductions that were never reconciled. Work through the checklist below before a labour officer, auditor or claimant does it for you.

1. Employment documentation

• A signed written contract for every employee, casual and intern, as required by section 9 of the Employment Act 2007.
• Job descriptions attached to each contract and re-issued when the role changes.
• A personnel file per employee: contract, ID/KRA PIN, academic and professional certificates, next of kin, and signed policy acknowledgements.
• Fixed-term and casual engagements reviewed so nobody has been rolled over into an implied permanent contract.

2. Statutory registrations and remittances

• NSSF, SHIF and PAYE registered, deducted at current rates and remitted by the statutory due date.
• The Housing Levy applied and remitted with payroll.
• NITA levy paid where applicable, and training reimbursements claimed.
• Twelve months of payment slips filed and reconciled against payroll — the reconciliation, not the intention, is what gets audited.

3. Policy manual and procedures

• A current HR policy manual referencing the Employment Act 2007, the Occupational Safety and Health Act 2007 and the Data Protection Act 2019.
• Documented disciplinary and grievance procedures, with the section 41 hearing process written down and actually followed.
• A sexual harassment policy issued to every employee, mandatory for employers with 20 or more staff.
• Leave policy covering annual, sick, maternity and paternity entitlements, with an auditable leave ledger.

4. Health, safety and welfare

• An OSH risk register reviewed at least annually, with named owners for each control.
• A constituted safety and health committee, trained, with minuted meetings.
• Statutory workplace registration, fire safety audit and annual OSH audit reports on file.
• WIBA cover in force and incident reporting logged within the statutory window.

5. Data protection

• Registration with the Office of the Data Protection Commissioner where thresholds apply.
• A data inventory covering HR, payroll, CCTV and recruitment data, with retention periods stated.
• Employee privacy notices issued, and consent recorded where consent is the lawful basis.
• A breach response procedure with the 72-hour notification path written down.

6. Exit and records

• Certificates of service issued on termination, without exception.
• Final dues computed and paid within the contractual window, with the calculation retained.
• Redundancy notifications to the labour officer and the union where applicable.
• Records retained for the statutory period and stored so they can be produced on demand.

How to use this checklist

Score each line: evidenced (the document exists and is current), claimed (it happens, but nothing is filed) or absent. Anything not evidenced is treated as absent in an audit. Close the absent items first, then the claimed ones — the second group is usually the cheaper and faster win.

DPPC runs this as a fixed-scope HR compliance audit: we test every line above against your actual files, hand back a defensible compliance file with the gaps closed, and leave your team with the templates and registers to keep it current.