Kenya's data protection regulator is confronting a growing problem: the country's digital economy is developing faster than some of the legal and investigative mechanisms designed to protect the personal information behind it.
Artificial intelligence is entering financial services, businesses are adopting offshore software and cloud platforms, and government agencies are working towards interconnected digital systems. Each development creates new demands on the Office of the Data Protection Commissioner (ODPC), whose authority was established under the Data Protection Act, 2019.
The law gave Kenya a framework for regulating how organisations collect, process, store and share personal information. Six years into its implementation, however, the regulator is confronting questions that extend beyond the legislation's original provisions.
Immaculate Kassait, who is leaving office as Kenya's first Data Commissioner, says the Act requires amendments covering artificial intelligence, sensitive personal information, penalties and data governance. She also wants the ODPC to receive stronger powers to investigate organisations operating outside Kenya and more time to determine complaints.
Her assessment comes as President William Ruto nominates Lydia Sitienei Chelagat, the Communications Authority of Kenya's Director of Legal Services, to succeed her. Chelagat's nomination was announced on 10 November 2026 and forwarded to the National Assembly for consideration.
The transition comes as several parts of the Kenyan economy are developing their own requirements for handling personal information, leaving…
