Governance by Consensus: A reflection on Commissioner Kassait's journey to effective Data Protection in Kenya

The Senior Counsel's tenure as the Data Protection Commissioner is nothing short of excellence. Immaculate Kassait took up the role of regulator in this field with nary a precedent and turned it into one of the most formidable sectors in the Kenyan industry. Her work in Data Protection and Privacy is characterised by timely regulations, sound guidance notes to industry actors and an open door policy which has propelled the awareness and implementation of data subject rights.

The Office of the Data Protection Commissioner was established in 2020 following the enactment of the Data Protection Act, 2019. The Commissioner built the office from scratch and grew the budget quota from 24M to 800M.

The Office has won four global awards for data privacy excellence; Regulations for the implementation of data subject rights such as registration of data controllers and processors, complaints handling and enforcement, and civil registration have been issued; and Twenty four guidance notes have been issued, including guidance notes for DPOs and guidance notes for processing children's data, all which can be found on the ODPC website.

She also ensured public participation and engaged head on with data protection matters through Town Halls in collaboration with the Data Privacy and Governance Society of Kenya (DPGSK). These forums provide a platform for professionals within the data protection space to understand the inner workings of the Office and have their challenges addressed directly.

One of the key determinations made by the Commissioner was ODPC Complaint No. 677 of 2022. This case challenged the jurisdiction of the Office in determining cases related to third party data sharing, contrary to the provisions of the Data Protection Act, 2019. The ODPC determined that it had the requisite jurisdiction to hear the matter as they were within the scope of the Act. The matter was however dismissed as the parties failed to produce the required documents for evidence of breach.

The Commissioner was always keen to give data controllers and processors a chance to fulfil their obligations as provided under the Act. In many cases, she gave warnings prior to issuing enforcement notices, and subsequently escalating to penalty notices. The most recent warning being the notice issued on 28th August 2026. It granted data controllers and processors whose registration certificates had expired fourteen days to renew them, failing which they committed an offence per the provisions of the Data Protection Act. Other warnings came in the form of decisions made by the Office. Some of those determinations include the decisions holding Whitepath Company Limited and Regus Kenya liable for breach of data subject privacy rights.

Initially, Whitepath Company Limited did not have an enforcement notice issued against them. The ODPC had received almost 150 complaints lodged against Whitepath for sending unwarranted and unsolicited text messages to unlawfully obtained contacts.They were only required to compensate the data subjects but failed to do so. The ODPC then proceeded to issue an enforcement notice against them on 10th January 2023 which they still failed to comply with, despite ample time to implement the recommendations of the Office. Eventually, a penalty notice was issued against them ordering them to pay penalties in the sum of five million Kenya shillings for non-compliance pursuant to Section 63 of the Act and Regulation 20 of the Complaints Handling and Enforcement Regulations. 

Regus Kenya on the other hand was not cooperative with the investigations of the ODPC. They were alleged to have frequently spammed the complainant with automated improper information despite the data subject’s attempts to stop these actions. At the first instance, Regus Kenya failed to respond to a Notification of Complaint dated 27th October 2022, then ignored a reminder to the Notification of Complaint dated 11th November 2022. Naturally, the Office issued an enforcement notice against them on 16th February 2023 which unfortunately received radio silence as well. In view of the numerous failed attempts at communication, a penalty notice was issued against Regus Kenya to pay a penalty in the amount of five million Kenya shillings to the Office.

Evidently, Immaculate Kassait valued accountability and consistently cultivated a culture of collaboration and professionalism. Just like the Commissioner,  we challenge businesses to protect personal data by design and by default by booking an appointment with us today. We are grateful for the Commissioner's guidance, vision, and commitment to effective protection of data subject rights in Kenya. Thank you for growing our beloved data protection space!