Why every Kenyan must protect their personal data

In recent days, Kenyans have expressed growing concerns over reports of unlawful recording, unauthorised sharing of images, videos and other forms of digital surveillance occurring without their consent. While many of these actions happen in public settings and via everyday technologies, the resulting violations are deeply personal. They undermine dignity, safety and livelihoods.

These developments are more than isolated headlines; they are a wake-up call. Every time we use smart devices, share content, or move through digitally mediated spaces, we become data subjects. Technologies that promise convenience and innovation can, when misused, become instruments of exploitation. Unlawful recording, unauthorised sharing, and surveillance without consent are not trivial acts. They are violations of personal data rights.

Kenya’s Data Protection Act, 2019, is clear. Personal data includes images, videos, and any information that can identify an individual. Personal data must be collected lawfully, fairly, and transparently. Consent is not optional. Dignity is not negotiable.

Last week, the Office of the Data Protection Commissioner (ODPC) hosted a four-day Data Privacy and Data Protection training in Wajir County in partnership with Huawei Technologies. The programme equipped young people with practical skills to navigate the digital world safely, understand their personal data rights and practice responsible digital citizenship. For many participants, who are also first-generation internet users in a frontier county, the training transformed abstract concepts into tangible, everyday knowledge. Similar trainings have been conducted in Nairobi, Migori, Homabay, Kisumu, Mombasa and Nyandarua counties in the last three months.

These efforts highlight an important reality. As digital technologies become embedded in daily life countrywide, the need for data protection awareness is urgent and universal. Digital and data protection literacy is not a luxury. It is a necessity.

Where violations occur, citizens are not powerless. Any individual may lodge a complaint with the ODPC, which has investigative powers, including the authority to issue enforcement notices, administrative fines, and order the cessation of unlawful data processing. Where criminal conduct is involved, we work closely with law enforcement and other government agencies. As such, Data protection enforcement is not theoretical. It is actionable.

Yet enforcement alone is not enough. Digital literacy gaps remain significant and deeply gendered. Across Kenya, only 35 per cent of women use mobile internet compared to 50 per cent of men. For every 100 young men with digital skills, only 65 young women have similar competencies. These gaps are often more pronounced in marginalised and frontier regions, limiting access to education, employment and participation in the digital economy.

Closing these gaps matters. When young people are equipped with data protection knowledge and digital skills, they can participate in e-commerce, online learning and use social media. For Kenya’s 7.4 million MSMEs, nearly half of which are run by women, such knowledge translates into inclusive economic growth and achievement of the Sustainable Development Goals.

Recent developments also underscore a critical responsibility for those who design and deploy technology. Privacy must be embedded by design, not treated as an afterthought. Device manufacturers, platform developers, and innovators must build safeguards that prioritise consent, transparency and user control. Technology must be a shield, not a threat. When privacy-by-design is coupled with informed and vigilant users, the risks of online exploitation, gender-based digital violence, and data misuse are significantly reduced.

At the same time, awareness must meet people where they are. Social Media Platforms, Content creators and pop culture offer powerful and relatable avenues for spreading digital literacy. When complex topics such as data rights and online safety are communicated through channels that young people already use daily, awareness is more likely to translate into safer behaviour and lasting change.

For frontier and marginalised communities, targeted digital literacy initiatives are transformative. When young people understand their rights and responsibilities online, they participate confidently in education, entrepreneurship, and civic life. For women and girls, this knowledge reduces vulnerability to online harassment and exploitation. For businesses operating online, compliance with data protection standards enhances credibility and competitiveness.

As we reflect on Safer Internet Day 2026, I urge tech companies, innovators, and civil society to extend digital literacy programs to every corner of the country. Investing in training, integrating privacy-by-design into devices, and leveraging creative platforms to reach young people are no longer optional interventions; they are national imperatives.

As Kenya advances its digital economy agenda, safeguarding personal data is not an obstacle to growth. It is the foundation for sustainable growth. Trust is the currency of the digital marketplace, and without it, innovation falters. The recent violation should therefore catalyse a national conversation around criminal accountability, digital ethics, device design, and collective responsibility. Civil society and educators must expand digital literacy outreach and citizens must assert their rights confidently.

In the digital age, protecting personal data is not a niche legal concern. It is a matter of dignity, equality and national resilience. Every Kenyan, whether in Nairobi, Wajir, Baringo or any other county, has both the right and responsibility to safeguard their data.

The writer is the Data Protection Commissioner, Office of the Data Protection Commissioner