NAIROBI, Kenya — Every time Kenyans click “accept all cookies,” connect to free Wi-Fi, like a social media post, or hand over a phone number at a supermarket checkout, they are paying for convenience not with money, but with personal data.
And according to Data Protection Commissioner Immaculate Kassait, most citizens do not fully understand how valuable that data has become in the modern digital economy.
Kassait warned that personal data now drives business decisions, advertising, service delivery, and political messaging, yet is often surrendered casually and without informed consent.
“If you want to know how valuable data is, just look at the digital economy. Data move it,” Kassait said.
She explained that what begins as seemingly harmless information — a name, phone number, location or email address — quickly transforms into a detailed digital profile once processed and analysed.
According to Kassait, data analytics can reveal where individuals shop, what they buy, how frequently they travel, their social interactions and, in some cases, their political preferences.
“That’s when it moves from just information that identifies you to information that tells deep secrets about you,” she said.
This same data underpins services many Kenyans now depend on daily, including targeted online advertising, mobile payments, digital lending, food delivery platforms and personalised social media content.
Kassait illustrated the point with a simple example drawn from everyday life in Nairobi.
During the recent hot weather, she searched online for a fan using Google and Instagram. Almost immediately, advertisements for sellers appeared, complete with phone numbers and WhatsApp contacts. Within hours, a delivery was arranged.
“That process is fueled by data,” she explained.
Digital platforms, she said, already knew what she was looking for, her approximate location, and how to reach her. At the same time, the seller gained access to her contact details and location — enough information to complete the transaction efficiently.
“That is the digital economy at work. And it’s powered by data we shared freely,” Kassait said.
However, the Data Commissioner cautioned that while data-driven services offer speed and convenience, they also expose citizens to risks when data is collected, stored or shared without adequate safeguards.
She noted that misuse of personal data can lead to identity theft, financial fraud, surveillance, discrimination, and manipulation, particularly where individuals are unaware of how their information is being processed or who ultimately controls it.
Kenya’s Data Protection Act, 2019, establishes principles governing the collection and use of personal data, including the principles of lawfulness, transparency, data minimisation, and accountability. It also grants citizens rights to access, correct, and object to the processing of their data.
Kassait stressed that both public and private entities are legally required to comply with the Act, including obtaining valid consent and ensuring data security.
She urged Kenyans to become more cautious and informed digital citizens by questioning why data is being collected, how it will be used, and whether it is truly necessary for a given service.
“Data is not free. When you give it out, you are paying with something very valuable,” Kassait said.
