President William Ruto announced on 9 November 2026 that he had nominated Lydia Sitienei Chelagat as Kenya's next Data Commissioner. Government Spokesperson Charles Owino said the President acted on a recommendation from the Public Service Commission (PSC). It had shortlisted 13 candidates for interviews in October, from a field of 152 applicants, according to Citizen Digital. She would succeed Immaculate Kassait, whose single, non-renewable six-year term is ending. The nomination has gone to the National Assembly. At the time of writing, reports from 9–10 November say no vote has been held.
This is a personnel story. It is also the first time the Office of the Data Protection Commissioner (ODPC) has changed leaders. The way the handover goes will shape how predictable Kenyan data protection is for founders, banks, telcos and startups.
The case for a strong regulator
The strongest argument for a tough ODPC is that it has delivered for ordinary people. Kassait said in January 2026 that the office had issued 184 compensation orders since the Data Protection Act, 2019 took effect. Capital FM reported that this came out of 9,061 complaints, together with 357 determinations, 134 enforcement notices and 20 penalty notices. The office has also resolved 84 cases through alternative dispute resolution and registered more than 15,000 entities. Before 2019, a Kenyan whose data was misused had little recourse. A regulator that can order a bank or lender to pay a complainant is a real change, and anyone arguing for lighter touch should start by admitting that.
What the numbers also show
The same figures point to a different problem. Only 184 compensation orders came out of 9,061 complaints, about 2%. Most complaints end in other ways, such as mediation, dismissal or settlement. A large intake with a small share of formal outcomes is normal for a young regulator. It also shows that outcomes depend heavily on how complaints are triaged, and the public record on that is thin. The Capital FM report gives no breakdown of the compensation by sector or amount, and no named cases. Firms deciding how much to invest in compliance cannot easily tell which conduct draws an order, which draws a notice, and which draws nothing.
The same report cites statutory exposure of fines up to Sh5 million, up to 10 years' imprisonment, or both. Penalties of that kind are defensible when they are applied in proportion to the harm. The risk for innovation is that a small Nairobi fintech and a multinational face the same uncertainty about how those tools will be used. The incoming Commissioner can reduce that uncertainty by publishing enforcement reasoning in a consistent format, not only headline totals.
The emerging-technology question
The ODPC has also been writing rules for newer technology. Digital Policy Alert tracks a Guidance Note on Emerging Technologies that the ODPC opened for consultation on 1 August 2026 and closed on 17 August. The tracker's summary says it is aimed at public and private entities deploying Internet of Things systems. I could not open the ODPC's own text of the note, because the link I tried returned a 404. I therefore cannot say which technologies the final version covers, or whether it was finalised as published. That uncertainty is itself a point. If a guidance note is the main way Kenya will apply the Act to AI, sensors and biometrics, it matters whether it is binding or advisory, and whether firms can rely on it as a safe harbour.
For contrast, the Electronic Frontier Foundation argued in October 2026 that Brazil's data protection authority should keep privacy and free expression at the centre as it takes on platform regulation. The same logic applies in Nairobi. A data protection authority that drifts into content or platform policing without clear statutory limits can end up threatening speech as well as protecting privacy.
What the National Assembly should ask
Parliament's vetting is the one public chance to set expectations for the next six years. A few questions would be worth putting to Chelagat:
- Publication: Will the ODPC publish anonymised determinations, with reasoning, so firms can see where the lines are?
- Proportionality: How will she distinguish careless breaches by small firms from systemic misuse by large ones?
- Status of guidance: Will guidance notes on emerging technologies carry legal weight, and will compliance with them count as a defence?
- Independence: How will she keep the office independent of the executive that nominated her, given that the Act gives her a single, non-renewable term?
The single term is a safeguard. A Commissioner who cannot be renewed has no reason to please the appointing authority. That makes the nomination process and the vetting record more important, not less.
Bottom line
Kassait's tenure shows that Kenyan data protection can produce remedies for individuals. The next phase has to show that it can do so predictably. For a market that depends on mobile money, digital credit and startup growth, clear and consistent enforcement is better than either permissiveness or a rulebook that firms discover case by case. The National Assembly should confirm a Commissioner promptly, and ask for commitments on transparency before it does.