13 candidates shortlisted as Kenya prepares to replace Data Commissioner Kassait
Kenya has shortlisted 13 candidates for the position of Data Protection Commissioner, putting the succession to Immaculate Kassait into its next stage as the country’s digital economy generates more personal data across AI, financial services, government platforms and connected enterprise systems.
Media Council of Kenya CEO David Omwoyo is among the candidates selected from 152 applications received by the Public Service Commission (PSC), with interviews scheduled for October 5, 2026.
The appointment will determine who heads the Office of the Data Protection Commissioner (ODPC) after Kassait, Kenya’s inaugural Data Protection Commissioner, completes her single six-year term later this year. The office was established under the Data Protection Act, 2019, giving institutional effect to Kenya’s privacy framework and responsibility for regulating the processing of personal information.
Omwoyo’s inclusion also has a direct connection to the data-protection ecosystem. The Media Council of Kenya has worked with the ODPC on training journalists and media organisations on their responsibilities when handling personal information, while Omwoyo has participated in ODPC engagements on data protection and the media.
13 candidates shortlisted to replace Immaculate Kassait
The PSC shortlisted 13 candidates after applications closed on September 14. The list includes Omwoyo, Senior Deputy Data Commissioner Oscar Otieno Onyango, Communications Authority of Kenya legal director Lydia Chelagat Sitienei, ICT professionals and other candidates with backgrounds spanning law, technology and public administration.
The interviews are scheduled to take place at the PSC offices in Nairobi on October 5. The commission has also invited members of the public to submit credible information concerning the shortlisted candidates as part of the recruitment process.
The shortlist itself does not determine who will eventually hold the office. It marks the point at which the recruitment moves from a national application process to interviews and subsequent stages of appointment.
What makes the succession particularly significant for the technology sector is the environment in which the new commissioner will operate. When Kassait took office in 2020, the basic task was to establish a functioning data-protection regulator and give practical force to a relatively new legal framework. The technology landscape now contains far more interconnected systems and data-intensive services. TechTrendsKE’s August analysis of the succession found that Kassait’s replacement will inherit a regulatory environment in which personal information is increasingly tied to digital finance, cloud services, AI and public-sector systems.
The regulator is inheriting a more complex digital economy
Personal data now sits inside many of the services Kenyans use every day. Mobile-money accounts, digital lending platforms, banking applications, ride-hailing services, online marketplaces and government portals all generate information that can identify individuals, describe their behaviour or reveal where and when they use particular services.
That creates a broader regulatory perimeter for the ODPC. The question is no longer limited to whether an organisation has a privacy policy or obtained information lawfully. Regulators also have to consider how information moves between systems, who can access it, how long it remains available and whether it can be reused for purposes different from those for which it was collected.
Recent technology developments make that problem more complicated. Kenya is building backend infrastructure intended to allow public institutions to communicate through secure APIs, with the government also preparing for AI agents to support public-service delivery. ICT and Digital Economy Principal Secretary John Tanui described the backend as the next frontier after platforms such as eCitizen.
Interoperability can reduce duplication and allow public services to work with information already held by government. It also means that information collected by one institution can become accessible to another system, subject to the permissions and safeguards governing that exchange. The technical architecture therefore becomes part of the privacy question.
AI is changing what data protection means
The arrival of AI adds another layer because modern AI systems can process information at a scale and speed that traditional software applications were not designed around.
TechTrendsKE reported in August that the ODPC had proposed safeguards for Kenyan organisations transferring personal information to offshore AI providers. The proposed approach places responsibility on organisations to consider the protections available in the destination jurisdiction and establish appropriate safeguards when personal data is processed outside Kenya.
That issue becomes more difficult when AI systems are connected directly to enterprise data.
Coverage from WSO2Con Africa 2026 in Nairobi showed how AI agents can be connected to existing enterprise information through APIs, tools, Model Context Protocol and retrieval-augmented generation. An agent can therefore move beyond generating an answer and retrieve information from a business system or use an existing capability through an API.
The governance question follows immediately. If an AI agent can retrieve a customer record, access an internal database or trigger a workflow, an organisation needs to establish which agent is acting, what authority it has, which information it can access and how its actions can be audited. TechTrendsKE’s reporting from the conference found identity, access controls, observability and bounded authority emerging as core components of agent governance.
That makes the next Data Protection Commissioner relevant to a technology debate that extends beyond conventional privacy compliance. AI agents could eventually become another category of software actor operating inside systems that contain personal information, even though the legal and technical mechanisms for governing such activity are still developing.
Government systems are becoming more interconnected
The government’s plan to connect public institutions through APIs illustrates why data governance will become more important as digital infrastructure expands.
The state has already built citizen-facing services through eCitizen and is now focusing on the backend connections between agencies. The stated objective is to allow government systems to communicate and exchange information securely while supporting more coordinated digital services.
The architecture being discussed across Kenya’s technology sector goes beyond data exchange. WSO2Con Africa coverage has examined digital identity, API management, enterprise integration and data access as foundations for AI-enabled government services. The technical components are closely connected because an AI system that can act across government services needs an identity, defined permissions and access to specific data and capabilities.
For the ODPC, that creates a practical oversight challenge. Greater interoperability can make government services more efficient, but the information being exchanged remains subject to the rules governing personal data. The regulator’s role therefore intersects with the architecture of digital government itself.
Financial and digital platforms are creating deeper data trails
Financial services provide another example of how the value and sensitivity of personal information are growing together.
TechTrendsKE’s recent coverage of Kenya’s digital finance sector has examined the expansion of mobile money, digital lending and data-driven credit decisions. Broader access to financial information can help lenders assess borrowers, but it also raises questions about accuracy, lawful sharing, profiling and automated decisions.
The same principle applies to digital platforms outside finance. A ride-hailing service can hold location, payment and trip information; a telecommunications provider can hold communications and subscriber information; an online retailer can hold purchasing and delivery information. Each dataset may look routine in isolation, yet combining them can produce a much more detailed picture of an individual.
That is why data governance increasingly concerns the connections between datasets as much as the individual records themselves.
The next commissioner will inherit an expanding regulatory perimeter
The shortlist comes at a point when Kenya’s technology infrastructure is also expanding. New data-centre capacity, cloud services, AI adoption and enterprise integration are increasing the amount of information being processed through digital systems, while cybersecurity threats continue to put pressure on organisations holding sensitive information.
TechTrendsKE’s reporting from WSO2Con Africa captured another aspect of this change: enterprises are trying to move AI from isolated pilots into production systems where agents can interact with existing applications, data and workflows. That requires identity, API controls, integration, observability and governance around the AI layer rather than treating the model as a standalone application.
The same architecture has consequences for privacy. Data protection increasingly depends on controls that operate across the entire technology stack, from the database and API to the identity system, cloud environment and AI application. A privacy regulator can establish the rules, but organisations need technical mechanisms capable of enforcing them.
For the incoming commissioner, that means the job will involve a technology landscape that is more interconnected than the one inherited by Kassait in 2020. The central regulatory questions will continue to concern lawful processing, individual rights and accountability, but they will increasingly arise inside AI systems, financial platforms, digital government infrastructure and cross-border cloud environments.
The PSC’s 13-candidate shortlist is therefore the immediate news. The larger technology story is what the successful candidate will inherit: a Kenyan economy in which personal information is becoming deeply embedded in the systems that deliver financial services, public services and AI-enabled business operations.
The selection process will determine who takes responsibility for regulating that environment, but the underlying challenge will remain the same regardless of which candidate ultimately takes the office: keeping control, accountability and individual privacy aligned with a digital economy that can move data across more systems, services and automated processes than the first Data Commissioner faced.
Real ESG impact doesn’t happen in panels alone, it happens in the rooms where financiers, operators, and policymakers actually align. Our GreenShift Forum 2026 cuts the noise, bringing together the people rewiring Africa’s sustainability and energy frameworks for one focused day in Nairobi. Secure your seat.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to info@techtrendsmedia.co.ke
