NAIROBI, Kenya- Kenya’s control over its critical data is increasingly under threat, with insufficient funding and lax regulations undermining the country’s data sovereignty.
This is the alarming conclusion from the Kenya Institute for Public Policy Research and Analysis (KIPPRA), which has raised concerns about the government’s current approach to data protection.
KIPPRA’s recent report, Building Personal Data Sovereignty in Kenya, highlights the significant disparity in budget allocation for Kenya’s data protection efforts compared to other nations.
The Office of the Data Protection Commissioner, responsible for safeguarding personal data, received a meager Ksh 270 million in the 2022/2023 financial year.
This allocation pales in comparison to the billions funneled into other ICT projects, such as the Konza Data Centre and the National Optic Fibre Backbone Expansion.
This underfunding is creating critical gaps in Kenya’s regulatory framework, particularly in enforcing data localization—a concept where a country’s digital information is subject to its own laws and governance structures.
While Kenya has introduced legal instruments like the Data Protection Act, the lack of a comprehensive national data management policy and the necessary supporting strategies has hampered the effective implementation of these laws.
Data sovereignty is more than just a buzzword; it’s a fundamental aspect of national security and economic stability. It ensures that Kenya retains control over the data generated within its borders, including how it’s stored, accessed, and used.
Yet, as KIPPRA points out, the country is currently ill-prepared to handle the complexities of data governance. The unrestricted cross-border transfer of personal data raises significant concerns around privacy, trust, and national sovereignty.
“Despite having relatively new legal and policy instruments for data localization, there is a pressing need to assess Kenya’s preparedness and address key considerations for achieving data sovereignty,” said Humphrey Njogu, a principal policy analyst at KIPPRA.
One of the report’s key recommendations is the development of local infrastructure, such as data centers, to support domestic data processing.
Most of Kenya’s personal data is currently processed abroad due to the superior, cost-effective data products offered by international players. This not only puts Kenya’s data at risk but also stifles the growth of a robust local data economy.
KIPPRA emphasizes that with global data creation expected to exceed 180 zettabytes by 2025 and nearly every person over six years old predicted to be digitally active by 2030, Kenya must act swiftly.
The country needs to strengthen its data governance framework to protect its citizens and harness the economic potential of its growing digital footprint.
With Kenya accounting for 7.7pc of Africa’s Internet economy—a figure projected to rise to 15.17pc by 2050—there is a clear incentive for the government to invest more heavily in data protection initiatives.
