Lydia Sitienei Chelagat nominated as Kenya prepares for a new era at its data protection office

President William Ruto has nominated Lydia Sitienei Chelagat as Kenya’s next Data Commissioner, setting in motion the final stage of the appointment process for the country’s data protection regulator. The nomination has been transmitted to the National Assembly for consideration under the Data Protection Act, Cap 411C, as the Office of the Data Protection Commissioner (ODPC) prepares for a leadership transition following Immaculate Kassait’s six-year tenure.

The announcement was made on Monday, November 9, by Government Spokesperson Charles Owino Wahong’o, who said the President acted on the recommendation of the Public Service Commission (PSC) in exercising his constitutional prerogative as Head of State.

Chelagat’s nomination follows a recruitment process that attracted 152 applications, according to the recruitment details reported by TechTrendsKE in September. The PSC shortlisted 13 candidates and scheduled interviews for October 5 as Kenya prepared to replace Kassait, who has led the data protection regulator for six years.

Kassait leaves behind an established data protection institution

As Kenya prepares for new leadership at the ODPC, the Commission on Administrative Justice (CAJ) has credited outgoing Data Commissioner Immaculate Kassait with establishing and strengthening the institution during her tenure.

Speaking at Kassait’s farewell dinner on November 5, CAJ Vice-Chairperson and Access to Information Commissioner Dorothy Jemator commended her contribution to institutional growth and the protection of information rights. Jemator said Kassait leaves behind an institution with a distinct identity, an expanding body of jurisprudence and regulatory guidance, and a strong foundation for future leadership.

Her assessment adds an institutional perspective to the leadership transition. During Kassait’s tenure, the ODPC developed its role in overseeing how public institutions and private organisations collect, process, store and share personal information, while building an enforcement record across sectors handling sensitive data.

Jemator also highlighted the relationship between access to information and data protection, explaining that the former promotes transparency, accountability and openness, while the latter safeguards individual privacy, dignity and personal information. The two responsibilities often intersect when public institutions handle requests for records containing personal information.

The CAJ and ODPC have maintained a working relationship through consultations, capacity building, experience-sharing and mutual referrals. Jemator revealed that the institutions are developing a joint advisory opinion to clarify the intersection between access to information and data protection, an initiative intended to provide guidance on the responsibilities involved in handling information held by public institutions.

She reaffirmed the CAJ’s commitment to continuing the partnership with the ODPC as Kassait leaves office, while encouraging her to remain engaged in advancing information rights through her experience and professional networks.

The regulatory challenges awaiting Kenya’s next Data Commissioner

Chelagat will take over leadership of the ODPC at a time when data protection questions extend across artificial intelligence, digital lending, cloud computing and government information systems.

One of the emerging regulatory issues concerns the use of overseas AI platforms by Kenyan businesses. In August, TechTrendsKE reported on proposed ODPC guidance addressing personal data transfers to foreign AI providers, including safeguards around international transfers, contractual protections and the responsibilities of organisations using external services to process customer information.

The proposals are relevant to banks, insurers, telecommunications companies and healthcare providers that rely on cloud-based systems and AI applications to handle information. TechTrendsKE’s October coverage also examined the risks of employees uploading customer information to external AI platforms, particularly where businesses lack clear rules governing the use of such tools.

Digital lending presents another established enforcement challenge. Kenyan lenders collect sensitive financial and personal information when assessing borrowers, while concerns over access to phone contacts, debt collection practices and misuse of customer information have featured prominently in the country’s data protection debate.

TechTrendsKE’s February reporting examined concerns about digital lenders’ handling of borrowers’ information and the government’s efforts to bring the sector under tighter regulatory oversight. The ODPC’s work in this area forms part of the broader enforcement responsibilities facing its next head as digital financial services serve more consumers.

Government institutions also fall within the regulator’s oversight responsibilities. Public-sector agencies collect and exchange personal information through digital services, interconnected databases and other systems, raising questions around access controls, information sharing and the safeguards applied when government departments process citizens’ data.

The debate has extended to proposed internet usage monitoring arrangements and the collection of subscriber information. TechTrendsKE’s August reporting examined concerns around proposals for internet usage metering, while its September coverage discussed the government’s plans for greater interoperability between public-sector systems through secure application programming interfaces.

The regulatory environment also intersects with proposals governing online platforms. TechTrendsKE reported on November 4 that proposed amendments to Kenya’s communications law could introduce additional reporting obligations for social media companies, including Meta, TikTok and X. The proposals also brought attention to the relationship between platform regulation, data protection compliance, age verification and content filtering.

These issues place the next Data Commissioner at the intersection of privacy regulation, technology adoption and public-sector digitalisation. The ODPC’s work will affect how organisations approach personal information, particularly where data processing involves external technology providers, automated systems or multiple institutions.

Five state corporations also get new chief executives

The government announcement also confirmed five leadership appointments across state corporations, with the respective boards making the decisions following competitive recruitment processes.

Waweru Karanja has been appointed Chief Executive Officer of the Privatization Authority, while Wakhungu Patrick Murunga will lead the Regional Centre on Groundwater Resources Education, Training and Research in Eastern Africa (RCGW).

Peninah Wangare Wahome has been appointed Chief Executive Officer of the Anti-Doping Agency of Kenya (ADAK). The agency oversees anti-doping activities in the country’s sporting sector.

The National Housing Corporation will have John Washington Agutu as its Acting Chief Executive Officer, while Dr. Janerose Omondi has been appointed Acting Chief Executive Officer of the Kenya National Entrepreneurs Savings Trust (KNEST).

The appointments were announced by Government Spokesperson Charles Owino Wahong’o on November 9, alongside Chelagat’s nomination to lead Kenya’s data protection regulator.

Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.

Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to editorial@techtrendsmedia.co.ke