ROMER · Insights

Informational only · not legal advice
romer.co.ke

From the CEO

A note from Mercy Barasa

CEO & Founder, Romer

As we settle into the second half of 2026, we also mark six years since the Data Protection Act (DPA) came into force in Kenya. Initially the DPA was perceived as a barrier to growth. Businesses were adapting to digital operations, and suddenly the law required new measures, new processes and new accountability, which meant additional expense.

But the DPA was never meant to slow businesses down. It was designed to protect the very people who enable our organisations to exist: our customers, users, members, patients and employees. It reminded us that personal data is not just any other data set: it is an extension of people, and therefore must be treated with dignity, care and responsibility.

Today we have seen a remarkable shift. Many organisations have moved beyond the mindset of “comply because the law requires it” to embracing data protection from a strategic standpoint, as a competitive advantage and a driver of trust. This year’s Data Privacy Day theme, “Trust the Data, Drive the Future,” underscored exactly that: highlighting the importance of good governance in AI, secure cross-border data flows and stronger privacy frameworks as foundations for a thriving digital economy.

This is why, in this newsletter, we place a spotlight on third-party compliance. As more businesses rely on outsourced services, vendor management and accountability have become essential pillars of effective data protection compliance.

Public Interest Is Not a Free Pass

One of the most interesting discussions during the recent Data Protection for the Public Sector workshop centred on a question many public officers have asked since the Act was enacted: “If most government processing is necessary for national security or undertaken in the public interest, are public institutions really required to comply with the Data Protection Act?”

Government institutions collect and process personal data to issue national identity documents, administer healthcare, collect taxes, deliver social protection programmes, conduct censuses, manage public finances and implement national development initiatives, most under statutory mandates and for the benefit of the public. Many participants therefore expressed the view that these activities fall within the exemptions relating to public interest, public authority and national security. As the discussions progressed, and as we examined the recently issued ODPC Guidance Notes for the Public Sector, a different picture emerged.

The guidance makes it clear that public institutions are subject to the Act and its Regulations whenever they process personal data. Exercising official authority or pursuing a public interest objective does not remove the obligation to comply. Public interest and official authority allow government entities to process personal data without relying on consent in many circumstances, and may limit certain data subject rights where exercising them would undermine the public purpose. A citizen may not always be able to object or demand erasure where processing is necessary for public health monitoring or law enforcement. Yet this does not exempt public institutions from the core principles of data protection.

“Public interest may justify processing, but it does not eliminate responsibility.”

Workshop takeaway

Public entities must still process personal data lawfully, fairly and transparently. They must collect only what is necessary for a specific purpose, keep it accurate, apply appropriate security safeguards, maintain accountability mechanisms and set clear retention periods. They must provide privacy notices, facilitate applicable data subject rights, conduct Data Protection Impact Assessments for high-risk processing, report breaches, implement privacy by design and register where required.

Too often, compliance is viewed as a regulatory checkbox exercise, something completed because the law requires it. In reality, compliance is a strategic asset. Trust is one of the most valuable resources any government can possess: citizens are more willing to share information, adopt digital services and support innovation when they trust the institutions processing their data. Conversely, a lack of trust can slow national progress. The Huduma Namba case is a powerful example: a transformative national digital identity initiative stalled by concerns around privacy, safeguards, exclusion and governance. The issue was never simply about technology. It was about trust.

As Kenya advances towards greater digitalisation and data-driven governance, guided by the Kenya National Digital Master Plan 2022–2032’s vision of a connected, citizen-centric ecosystem, that trust becomes even more critical. Achieving the vision requires more than technology infrastructure. It requires trusted infrastructure.

Employers: Stop Using Consent as a Default Legal Basis

At our inaugural HR data protection summit, one issue kept resurfacing: the reliance on consent as the default legal basis for processing employee data. What surprised many attendees was the realisation that consent is often the weakest and least reliable lawful basis available. Can an employee realistically “opt out” of performance monitoring, attendance tracking or workplace supervision without worrying how that decision might be perceived? In most cases, no. The employer–employee relationship is inherently unequal, which makes it difficult to prove consent was freely given.

Employers therefore need to move away from placing every HR process under blanket consent clauses. The legal basis should be carefully matched to the specific activity. During recruitment, employers may rely on consent at the initial application stage, but the primary basis for most recruitment processing is contractual necessity. Employers should clearly explain why particular information is collected: to assess qualifications, verify eligibility to work or evaluate suitability. Transparency matters.

Once a candidate receives an offer, “performance of a contract” becomes the basis for processing. Payroll, benefits, work schedules, performance evaluations, staff badges and attendance records all fall squarely within contractual necessity: an employer does not need consent to process salary information or record working hours, because these are directly tied to the role and the employer’s obligations under the contract.

There are also circumstances where employers have a legitimate interest, such as monitoring system access, maintaining training records, or implementing reasonable security, provided employees’ privacy rights are not unfairly overridden. The key requirement is proportionality: a balancing exercise ensuring the processing is necessary, reasonable and connected to a clear business purpose. At the end of the employment cycle, it is good practice to inform the employee or seek permission before giving references, often addressed through exit documentation or employment policies.

By the close of the summit, we concluded that consent is only appropriate where participation is genuinely optional and unrelated to the core employment relationship, for example asking whether an employee would like their photo featured in a company brochure or on social media, which they can reasonably decline without repercussions. Ultimately, identify the correct legal basis for each activity, stay transparent, and process only where necessary, proportionate and lawful.

Holding the Reins

Under Kenya’s Data Protection Act, there are a few key roles every organisation needs to understand, because confusing the roles is where the problems begin.

In the Hot Seat

The ODPC issued over 100 decisions in 2025. Here are the ones every business working with third parties needs to read.

Protecting Yourself

Knowing you’re responsible is one thing. Doing something about it is another. Here’s how to start getting your third-party house in order.