President William Ruto has nominated Lydia Sitienei Chelagat, the Director of Legal Services and Corporation Secretary at the Communications Authority of Kenya (CA), as the country’s next Data Protection Commissioner, setting the stage for the first leadership transition at the Office of the Data Protection Commissioner (ODPC) since its establishment.
Chelagat, whose nomination was announced on November 9, 2026, is expected to succeed Immaculate Kassait, Kenya’s inaugural Data Protection Commissioner, who has completed her six-year, non-renewable term.
The nomination follows a competitive recruitment process that attracted 152 applicants, with 13 candidates shortlisted for consideration. Chelagat’s appointment is subject to vetting and approval by the National Assembly.
If approved, she will take charge of a regulator that has grown significantly over the past six years, with more than 15,000 registered data controllers and processors and an expanding enforcement mandate covering financial institutions, telecommunications companies, technology platforms, healthcare providers and government agencies.
Chelagat brings legal and regulatory experience from the Communications Authority, the government agency responsible for overseeing Kenya’s telecommunications, broadcasting, postal and electronic communications sectors.
Her experience at the CA comes as Kenya’s data protection regime faces increasingly complex questions surrounding artificial intelligence, biometric identification, digital financial services and the transfer of personal information across international borders.
The ODPC was established under the Data Protection Act, 2019, to regulate the processing of personal data, protect individuals’ privacy rights and enforce compliance among organisations handling personal information.
Under Kassait, the regulator introduced registration requirements for qualifying data controllers and processors, established complaints and investigations mechanisms, and began imposing administrative penalties against organisations found to have violated data protection laws.
One of its most prominent regulatory disputes involved Worldcoin, the cryptocurrency-linked digital identity project that collected biometric information from Kenyans in exchange for digital tokens.
In May 2025, the High Court ordered the deletion of biometric data unlawfully collected through the project. The ODPC subsequently supervised the deletion process, with the regulator confirming in January 2026 that the information had been deleted.
The regulator has also investigated complaints involving digital lenders, businesses accused of sharing customers’ personal information without consent, and institutions alleged to have failed to safeguard sensitive data.
Kassait’s administration helped position Kenya within international privacy regulatory networks, with Nairobi selected to host the 2027 Global Privacy Assembly, a gathering of data protection authorities from around the world.
Chelagat joined the Communications Authority in December 2023 and has more than 15 years of experience in legal services, corporate governance and regulatory affairs. She previously served as General Manager of Legal Services and Company Secretary at the Kenya Electricity Transmission Company (KETRACO), as well as Group Company Secretary and Head of Legal Services at CPF Financial Services.
She holds a Bachelor of Laws degree from the University of Buckingham in the United Kingdom and a master’s degree in Public Policy and Management from Strathmore University Business School. The Standard
Her nomination was made on the recommendation of the Public Service Commission (PSC), according to Government Spokesperson Charles Owino.
“The nomination has been transmitted to the National Assembly for consideration, in fulfilment of the legal requirements set out under the Data Protection Act, Cap 411C, Laws of Kenya,” Owino said. Daily Nation
The incoming commissioner will be responsible for enforcing Kenya’s data protection legislation, investigating privacy complaints, supervising compliance by public and private institutions, and overseeing the processing of personal information.
For technology companies, banks, digital lenders and telecommunications operators, the leadership change comes as regulators face mounting questions about how customer information is collected, monetised, transferred and used to develop artificial intelligence systems.
Chelagat will also inherit questions about the regulator’s ability to enforce decisions against multinational technology companies, strengthen cross-border data protection arrangements and ensure government digital services comply with privacy laws.
Under the Data Protection Act, the commissioner serves a single, non-renewable six-year term.
The National Assembly must now consider Chelagat’s nomination before she can formally assume office, with the transition expected to shape Kenya’s approach to data privacy regulation over the next six years.