Cybersecurity Policy Report, New Categories of Sensitive Data Proposed in Kenya, (Sep 15, 2026)

By Tony Foley

The Kenyan Office of the Data Protection Commissioner (ODPC) published a draft public notice last week that seeks to add categories of personal data to the definition of sensitive personal data under the country’s data protection law.

The draft notice, which may be downloaded from the ODPC’s consultation page, notes that the agency has the authority under section 47 of the Data Protection Act of 2019 to prescribe further categories of personal data as sensitive personal data and to specify any further grounds under which these prescribed categories of sensitive personal data may be processed.

The draft notice seeks to characterize trade union membership and political affiliation as sensitive personal data in certain cross-border transfer situations. Specifically, the ODPC said that, for the characterization to apply, the personal data in question must be transferred to Kenya via cross-border data transfer, and the originating law of the jurisdiction of origin, at the time of the transfer, must treat data regarding trade union membership and political affiliation as sensitive or special category data.

Data controllers and processors would be required under the notice to comply with the Data Protection Act’s sensitive personal data provisions with respect to these added categories and would be subject to enforcement measures and penalties for failure to comply. The ODPC is accepting comments on the draft notice through Sept. 25 via a form located on the consultation page or by e-mail at public.participation@odpc.go.ke.

News: InternationalLegislation DataPrivacy