Outgoing Data Commissioner Immaculate Kassait has warned about Kenya’s reliance on foreign digital infrastructure.
The outgoing Data Commissioner says foreign infrastructure dependence weakens Kenya’s bargaining power, while AI creates new privacy risks.
Outgoing Data Commissioner Immaculate Kassait has warned that Kenya risks losing data control through reliance on foreign technology infrastructure. She said limited local platforms and technical expertise weaken the country’s bargaining position with multinational companies.
Although Kenya has introduced policies to guide data processing, including a cloud policy, Kassait said dependence persists. The country largely adopts technologies developed elsewhere, leaving it struggling to keep pace.
Her warning comes as government services and businesses expand their use of digital systems. That shift increases the importance of safeguards governing how organisations collect, store, transfer and process personal information.
AI adds pressure on data control
Kassait also warned that artificial intelligence creates fresh challenges when organisations reuse personal information to train systems. She questioned whether people know when organisations feed their details into AI tools to develop products.
As information moves between data controllers, processors and AI platforms, she said organisations need clear accountability structures. In response to emerging risks, the Office of the Data Protection Commissioner (ODPC) has issued AI guidance.
The guidance outlines acceptable practices and responsibilities for organisations handling personal information, Kassait said. However, more comprehensive regulation could follow as regulators continue examining the technology’s implications.
She also urged developers to build privacy and security safeguards into products from the outset. Organisations should collect only information necessary for clearly defined purposes, rather than routinely seeking users’ contacts or health details.
Beyond those safeguards, Kassait called for stronger governance and digital public infrastructure using centrally managed, anonymised information. She said innovation must respect individual rights and dignity, rather than treat personal information solely as a commercial resource.
Cross-border enforcement remains unfinished business
Reflecting on six years at the ODPC, Kassait cited stronger accountability and greater public discussion among her achievements. However, she recalled early resistance from institutions accustomed to collecting and reusing personal information with little scrutiny.
Building the office also required staff capacity, resources and systems to oversee compliance. Outstanding priorities include ratifying the Malabo Convention on Cyber Security and Personal Data Protection, she said.
She also identified legal reforms to strengthen cross-border enforcement through mutual legal assistance. On complaints, Kassait said the commission considers its mandate, the seriousness of violations and the number of people affected.
It also assesses whether organisations have taken corrective action. Meanwhile, she maintained that government institutions face scrutiny too, with the commission recommending improvements where it identified weaknesses.
After leaving office, Kassait intends to remain active in the sector through further studies in cybersecurity and data governance. She also hopes to publish an autobiography about establishing the ODPC by the end of January.
