Kenya’s first Data Protection Commissioner, Immaculate Kassait, has concluded her six-year tenure after overseeing the establishment of the country’s privacy regulator, the registration of more than 15,000 data controllers and processors, and the introduction of enforcement measures against organisations accused of misusing personal information.
Kassait, who took office in November 2020 following the enactment of the Data Protection Act, 2019, leaves the Office of the Data Protection Commissioner (ODPC) at a time when artificial intelligence, biometric identification, digital lending and the growing collection of personal information by government agencies are reshaping Kenya’s privacy landscape.
President William Ruto nominated Lydia Sitienei Chelagat, Director of Legal Services and Corporation Secretary at the Communications Authority of Kenya, on November 9 to succeed Kassait. Her appointment is subject to approval by the National Assembly, marking the first leadership transition at the regulator since its establishment.
Kassait’s departure closes a formative chapter for an institution that began with fewer than 10 employees, many of them seconded from other government agencies, and initially operated from offices provided by the Communications Authority. The ODPC has since established its own headquarters, expanded its regional presence and developed systems for registration, compliance monitoring, investigations and enforcement.
One of the most significant achievements during her tenure was bringing thousands of businesses, government institutions and other organisations under a formal data protection framework. By 2024, the regulator had registered 7,223 data handlers, reviewed 138 Data Protection Impact Assessments, issued 192 advisories and conducted 58 audits and inspections.
Registrations exceeded 15,000 by early 2026, reflecting the expansion of regulatory oversight across sectors including financial services, telecommunications, healthcare, education and digital commerce.
The registration system requires qualifying organisations that process personal information to formally identify themselves to the regulator and comply with obligations governing how customer, employee and other personal data is collected, stored, processed and shared.
Enforcement became another defining feature of Kassait’s administration. The ODPC reported handling 9,061 complaints by early 2026, as Kenyans increasingly sought remedies for alleged privacy violations.
Under its 2025–2029 strategic plan, the regulator reported that its earlier planning period had produced 195 determinations, 100 enforcement notices and 12 penalty notices from 6,817 complaints received. These figures cover different reporting periods and reflect the development of the office’s enforcement system rather than its final six-year totals.
The complaints have involved organisations across multiple sectors, including digital lenders accused of accessing or sharing borrowers’ personal information improperly, healthcare providers, educational institutions and businesses alleged to have used photographs or other personal details without appropriate consent.
The regulator also established procedures through which individuals could challenge the handling of their information and seek remedies, including compensation where legally justified.
One of the most prominent privacy disputes during Kassait’s tenure involved Worldcoin, the cryptocurrency-linked digital identity project that collected iris scans from Kenyans in exchange for digital tokens. The ODPC scrutinised the company’s collection and processing of sensitive biometric information, raising questions about consent, data security and compliance with Kenyan privacy legislation.
In May 2025, the High Court ordered the deletion of biometric information unlawfully collected by Worldcoin, with the process to be supervised by the ODPC. In January 2026, the regulator confirmed that Tools for Humanity, the company behind the project, had deleted the information and that it had conducted a compliance audit to verify the exercise.
The case became a significant test of Kenya’s ability to apply its data protection laws to international technology companies operating in the country. It also highlighted the growing importance of biometric privacy as digital identity systems become more widely adopted. Kassait’s administration gained international recognition as Kenya strengthened its participation in global privacy regulation.
In September 2025, the ODPC received four awards at the Global Privacy Assembly in Seoul, South Korea, recognising initiatives in leadership, public education, dispute resolution, enforcement and innovation. The regulator’s work included digital education programmes, complaints management systems and the introduction of a chatbot designed to help citizens understand their privacy rights.
Nairobi was also selected to host the 2027 Global Privacy Assembly, positioning Kenya to convene international discussions on artificial intelligence, cross-border data transfers, cybersecurity and the responsibilities of multinational technology companies.
The ODPC expanded access to its services through regional offices and Huduma Centre desks, while introducing public awareness programmes, professional training initiatives and competitions intended to develop expertise in privacy law.
During the 2024/2025 financial year, the regulator reported conducting 75 inspections and audits and receiving 1,944 complaints involving alleged data protection violations.
For Kassait, one of the achievements was bringing privacy protection into public discussion in a country where awareness of personal data rights had previously been limited.
“I think we’ve made data protection a conversation in this country,” she said as she prepared to leave office.
Despite the institutional expansion, significant challenges remain. Kenya’s growing digital economy has created new questions about the use of personal information by artificial intelligence systems, digital lenders, online platforms and public-sector databases. The increasing use of facial recognition, biometric identification and automated decision-making has also raised concerns about whether existing enforcement mechanisms can keep pace with technological developments.
Kassait has identified cross-border enforcement and Kenya’s dependence on foreign technology infrastructure as areas requiring further attention, particularly as multinational companies process information across multiple jurisdictions.
The regulator’s financial penalties are also limited by law to KSh 5 million or 1% of an organisation’s preceding annual turnover, whichever is lower, potentially constraining the financial consequences of violations involving large corporations. Questions about institutional resources, the enforcement of decisions and the handling of complaints against public bodies remain important issues for the next commissioner.
Chelagat, if approved by Parliament, will inherit an institution with an established regulatory framework, thousands of registered organisations and a growing record of investigations and enforcement decisions. Her administration will face the challenge of strengthening compliance while responding to emerging privacy risks associated with artificial intelligence, digital identity, financial technology and the government’s expanding digital infrastructure.
For Kassait, the conclusion of her tenure marks the transition from establishing Kenya’s first dedicated data protection regulator to determining how effectively the institution can enforce privacy rights in an increasingly data-driven economy.
