On 30 September 2026, Kenya's Public Service Commission (PSC) shortlisted 13 candidates, from 152 applications, to succeed Immaculate Kassait as Data Protection Commissioner. TechTrendsKE reports that interviews were set for 5 October 2026. Kassait, the first holder of the office, completes her single six-year term later this year. At the time of writing we found no report of a final appointment. That makes this a good moment to ask what the Office of the Data Protection Commissioner (ODPC) needs from its second leader.
The case for a forceful regulator
The strongest argument for an aggressive successor is simple, and it deserves a fair hearing. Kenya's data economy runs on mobile money, digital lending and government platforms. Harms there are concrete: unsolicited debt-collection messages, leaked identity records, and surveillance by poorly secured systems. Press reports of the ODPC's own figures, summarised by AllAfrica in January 2026, cite roughly 9,000 complaints since the law took effect, and 184 compensation orders to people affected. A regulator that moves slowly while those harms pile up is not neutral. It simply leaves individuals to carry the cost.
The design of the office reflects this concern. Under the Data Protection Act, 2019, the Commissioner is appointed for a single term of six years and cannot be reappointed (section 7(2)). Recruitment starts with the PSC, and the President appoints with the National Assembly's approval. A non-renewable term means the Commissioner has no reason to court the people being regulated, or the government that might reappoint them. That is a real strength of the Kenyan model, and we think it should be defended.
What the next Commissioner inherits
The agenda is wider than the one Kassait began with in 2020. Our hook lists AI systems, offshore AI providers, government API interoperability, mobile money, digital lending and cross-border cloud services. Each is a place where the ODPC must apply a 2019 statute to technology its drafters did not foresee. That is a job of interpretation, and enforcement alone will not do it.
The ODPC has so far worked mainly through complaint determinations, enforcement notices and fines. Its first penalty notice, against Oppo Kenya in December 2022, was KES 5 million, as Bowmans and other law-firm commentary record. Press reporting in January 2026 put the cumulative total at 20 penalty notices and 134 enforcement notices. That is a credible record for a young regulator. It also shows the office's limits. Complaint-driven enforcement catches the visible failures, such as a school or a lender that leaked records. It does not tell an AI developer or cloud provider what compliance looks like before something goes wrong.
Where proportionality matters
Our view is that the second Commissioner's most valuable output will be clear, predictable guidance, with penalties kept for real harm. Three areas stand out.
- AI and offshore providers. A Kenyan firm that uses a foreign model API is a data controller, and the provider is a processor. The ODPC should say plainly what a lawful transfer and a lawful processing contract look like. Vague warnings push small developers either out of the market or into non-compliance.
- Government interoperability. The state is the largest holder of Kenyans' data. A regulator that fines private firms but goes easy on public bodies loses credibility. Even-handed treatment of the public sector is a precondition for private-sector buy-in.
- Digital lending and mobile money. These produce the most complaints, and they are also what extends credit to people banks ignore. Enforcement should target abusive collection and unlawful data sharing, and it should not penalise lending as such.
The temptation will be to treat cross-border cloud as a localisation question. Requirements to keep data inside the country can look like protection, but they raise costs and often do not improve security. A capable Commissioner will favour transfer safeguards, such as contractual and risk-based tools, over blanket rules.
What the PSC process should weigh
The shortlist, per TechTrendsKE, includes a Media Council of Kenya chief executive, a senior deputy data commissioner from inside the ODPC and a legal director at the Communications Authority of Kenya. We take no position on individuals. The mix of backgrounds does show the trade-off. Insiders offer continuity and know the case backlog. Outsiders from media or telecoms regulation bring different instincts, including about speech and sector regulation. Because the office also sits in the same landscape as the Communications Authority and the ICT ministry, independence in practice matters as much as the statute.
We would weigh three things. The first is evidence of proportionate decision-making, meaning reasoned determinations that distinguish negligence from malice. The second is technical literacy about AI, cloud and payments. The third is willingness to publish guidance and consult on it before enforcing. A fourth, procedural point is timing. A gap between Kassait's departure and her successor's confirmation would leave the office without a Commissioner just as new compliance questions arrive, so the nomination and approval stages should move promptly.
Bottom line
Kenya's institutional design is sound. The single term protects independence, and the ODPC has shown it will use its powers. The risk now is less weakness than uncertainty for businesses deciding how to build. The best signal the next Commissioner can send in the first year is predictability: published guidance on AI and transfers, reasoned determinations, and penalties scaled to harm. That serves complainants, who get faster resolution, and innovators, who get rules they can follow.