The next time a mobile lender asks to access your call logs or a hospital receptionist photocopies your ID card “for the records”, you need to ask yourself several questions. Who said they could have that information? What are they doing with it? Can you get it back?
Kenya has an answer to these questions, and it is in a law called the Data Protection Act of 2019. The Office of the Data Protection Commissioner (ODPC), which was created to enforce that law, has been busy building one of Africa’s most detailed sets of rules about how your personal information should be handled. It has published guidance notes covering sectors from health and education to elections, the media, and the public sector.
What is the big idea behind these guidance notes? What philosophy runs through all of this? The simple answer is that your personal data belongs to you, and anyone who uses it must be able to justify doing so.
The Data Protection Act was not conceived in a vacuum. It exists to give life to Article 31 of the Constitution, which guarantees every person the right to privacy, including the right not to have information about their private life unnecessarily revealed.
That constitutional anchor matters because it means data protection is not just about ticking a box on a piece of paper. It is about a basic right that belongs to every Kenyan.
The ODPC’s guidance notes return to this point. Whether they are addressing a rural health clinic, a digital lender, or a TV journalist, the starting position is always the same: the person whose data you are holding has rights, and your job is to respect them. The Act sets out eight principles for handling personal data. They may sound technical, but they are really just common sense dressed in legal language. Collect data for a specific reason. Only collect what you need. Don’t keep it longer than necessary. Keep it accurate, secure and be honest about what you are doing with it. Be able to prove you are doing it right.
These principles do not stand alone but reinforce each other. If you are only collecting data for a specific purpose, you end up collecting less of it. If you collect less, you have an easier time keeping it secure and disposing of it when you are done. The whole system is designed to keep the person (the data subject) in control of their own information.
A common objection to data protection rules goes something like this: “All this regulation will slow down business, discourage innovation, make it harder to deliver services.” The ODPC’s guidance notes reject this argument firmly.
The public sector guidance note puts it plainly: as Kenya pursues its digital transformation agenda, protecting citizens’ data is not a barrier to that ambition but its facilitator. An e-government platform that people do not trust will not be used.
A digital lending app that harvests your contacts without permission will eventually face a legal or reputational backlash or both.
The ODPC argues that privacy and progress are not enemies, but partners. Businesses and institutions that handle data responsibly build the kind of trust that sustains long-term relationships with their customers and citizens. Those who cut corners may gain a short-term advantage, but they are building on a shaky foundation.
But rules don’t matter unless they are enforced. The ODPC is doing its job. As of January 2026, the agency had seen a significant increase in its workload and enforcement actions, receiving more than 9,000 data privacy complaints and issuing more than 300 formal determinations.
Some 184 compensation orders had been issued to individuals whose data rights were violated. Twenty penalty notices and 134 enforcement notices had been served to non-compliant data controllers and processors. And more than 80 cases were successfully resolved through the alternative dispute resolution mechanism.
These enforcement actions show that these rules have teeth. We are sending the message that in Kenya, your personal data is not a free resource for whoever happens to collect it. It is an extension of your constitutional right to privacy. Treat it accordingly.