A new Data Commissioner for Kenya: what the next six years should fix

A moment of transition

Kenya’s Data Protection Act, 2019 came into force on 25 November 2019, and the Office of the Data Protection Commissioner was established a year later.¹ The Data Commissioner serves a single, non-renewable term of six years.² On 25 August 2026 the Public Service Commission advertised the “impending vacancy” in the post, so Kenya is about to choose its second Data Commissioner.³

The first six years have built a working institution. The Office has registered thousands of data controllers and processors, opened regional offices in seven locations, and issued decisions that are now published on Kenya Law.⁴ They have also shown where the law and the institution need strengthening. This brief sets out what the next Commissioner, the Cabinet Secretary and Parliament should fix.

A busy complaints office

The Act gives people real rights and a practical route to enforce them. A complaint to the Data Commissioner must be investigated and concluded within 90 days, and a person who suffers damage can be awarded compensation.⁵ Kenyans have used that route in large numbers. According to its strategic plan for 2025 to 2029, the Office received 6,817 complaints in its first plan period and resolved 6,516 of them, issuing 195 determinations, 100 enforcement notices and 12 penalty notices.⁶ In January 2026 the Data Commissioner was reported as citing 9,061 complaints and 184 compensation orders.⁷

Compensation has become the Office’s main remedy. It ordered a beverage company to pay KSh 1.5 million to three people whose images it used commercially without consent, Nairobi Hospital to pay KSh 500,000 for using covert footage of a patient in an advertisement, and an internet service provider to pay KSh 700,000.⁸ Early complaints were dominated by digital lenders: by September 2022, 299 of the 555 cases admitted concerned them.⁹

Fines capped too low

Penalties tell a different story. The Act caps administrative fines at KSh 5 million or, for an undertaking, 1 per cent of the previous year’s turnover, “whichever is lower”.¹⁰ For a large company, 1 per cent of turnover would often be the higher figure, so the cap works in reverse: the bigger the company, the more certain it is that KSh 5 million is the most it can be fined.

The Office has reached that ceiling three times: against Oppo Kenya in December 2022, its first penalty notice, and against Whitepath and Regus Kenya in April 2023.¹¹ Its penalties have largely survived in court. Challenges by a school, a lounge and a digital lender to penalties imposed in September 2023 all failed.¹² But when the High Court upheld the Regus notices in September 2025, it halved the fine to KSh 2.5 million.¹³

The largest case of all ended without a fine. The Office restricted Worldcoin’s processing in 2022 and cancelled its registration in 2023. But the decisive ruling came on a judicial review brought by the Katiba Institute and others: on 5 May 2025 the High Court found that consent had been obtained “through inducement of a cryptocurrency” and ordered the biometric data erased within seven days, under the Commissioner’s supervision.¹⁴ The Office supervised the deletion in Germany, where the data was held.¹⁵

When the largest penalty the law allows is smaller than a rounding error in a multinational’s accounts, compliance becomes a cost of doing business.

The state, and the courts

The most significant checks on the state’s own data systems have also come from the courts. In 2020 the High Court allowed the national digital identity system to proceed only once “an appropriate and comprehensive regulatory framework” had been enacted.¹⁶ In 2021 it quashed the rollout of Huduma cards for want of the data protection impact assessment the Act requires.¹⁷ In July 2025 it quashed notices requiring the registration of mobile phone IMEI numbers, holding that an IMEI number “became personal data as soon as it was associated with a person”.¹⁸

The Office’s own record against public bodies is thin. A civil society analysis of its 2024 decisions found that only 2 of 51 determinations concerned public sector data handlers, and that they “were not as harsh” as those against the private sector.¹⁹ In March 2025 the Office asked the Auditor-General to include data protection in public audits, noting that even basic checks, such as whether a public entity has registered, are needed for public agencies to “begin their journey toward lawful data processing”.²⁰

The Office’s strategic plan is candid about the pressures. It lists “vested political interests on independent operations of ODPC” among its threats. It needs KSh 12.6 billion over the plan period against an expected KSh 9.0 billion, and it works with 91 staff.²¹

Decisions that fail in court

A heavy caseload has also made the Office’s decisions procedurally fragile. The High Court has held that a determination issued after the 90-day limit is “a nullity”, and has set aside compensation awards, one of them for lack of proof of service and of “meaningful investigations”.²² A statutory deadline that protects complainants from delay can also defeat them when an overstretched office misses it.

What the next six years should fix

Much of the agenda is already recognised. The Office has told the High Court that the Act “requires amendments to align with emerging challenges”, and its strategic plan identifies gaps in the Commissioner’s powers over foreign companies.²³ Kenya has also begun to build rules through guidance, including standard clauses for cross-border transfers issued in 2026, and the Cabinet has approved accession to the African Union’s Malabo Convention.²⁴

1. Raise the fine cap. Parliament should amend section 63 so that the maximum fine is KSh 5 million or a percentage of turnover, whichever is higher, as Nigeria’s law and the European Union’s GDPR provide.
2. Appoint for independence. The Public Service Commission and the National Assembly should run an open process with a published shortlist, and vetting should test each candidate’s readiness to enforce the law against the state.
3. Make the state’s data use a priority. The next Commissioner should audit the registration and impact assessments of public bodies, starting with national identity and health data systems, and publish the results.
4. Fund the plan. The Treasury should close the funding gap in the Office’s strategic plan and add investigators in proportion to complaints.
5. Make decisions robust. The Act should allow the Commissioner to extend the 90-day period for complex complaints, with reasons, and the Office should adopt service and investigation standards that meet the courts’ expectations.
6. Finish the international agenda. Parliament should complete accession to the Malabo Convention, and the government should keep data localisation confined to the narrow purposes set out in the 2021 regulations.