After six years of service, Kenya's first Data Protection Commissioner, Immaculate Kassait, has concluded her tenure at the Office of the Data Protection Commissioner (ODPC). Kassait took office in November 2020, following the enactment of the Data Protection Act, 2019. During her term, she oversaw the establishment of the country's privacy regulator, the registration of over 15,000 data controllers and processors, and the introduction of enforcement measures against organisations accused of misusing personal information.
President William Ruto has nominated Lydia Sitienei Chelagat, Director of Legal Services and Corporation Secretary at the Communications Authority of Kenya, to succeed Kassait. Chelagat's appointment is subject to approval by the National Assembly, marking the first leadership transition at the regulator since its establishment. Kassait's departure closes a formative chapter for an institution that began with fewer than 10 employees and initially operated from offices provided by the Communications Authority.
During Kassait's tenure, the ODPC achieved significant milestones, including registering 7,223 data handlers by 2024, reviewing 138 Data Protection Impact Assessments, issuing 192 advisories, and conducting 58 audits and inspections. By early 2026, registrations exceeded 15,000, reflecting the expansion of regulatory oversight across sectors such as financial services, telecommunications, healthcare, education, and digital commerce.
Enforcement became a defining feature of Kassait's administration, with the ODPC handling 9,061 complaints by early 2026. The regulator reported 195 determinations, 100 enforcement notices, and 12 penalty notices from 6,817 complaints received during its 2025–2029 strategic plan period. Complaints involved organisations across multiple sectors, including digital lenders, healthcare providers, and businesses alleged to have used personal details without consent.
One of the most prominent privacy disputes during Kassait's tenure involved Worldcoin, a cryptocurrency-linked digital identity project that collected iris scans from Kenyans. The ODPC scrutinised the company's collection and processing of sensitive biometric information, raising questions about consent, data security, and compliance with Kenyan privacy legislation. In May 2025, the High Court ordered the deletion of biometric information unlawfully collected by Worldcoin.
Kassait's administration gained international recognition as Kenya strengthened its participation in global privacy regulation. In September 2025, the ODPC received four awards at the Global Privacy Assembly in Seoul, South Korea, recognising initiatives in leadership, public education, dispute resolution, enforcement, and innovation. Nairobi was also selected to host the 2027 Global Privacy Assembly, positioning Kenya to convene international discussions on artificial intelligence and cybersecurity.
Despite institutional expansion, significant challenges remain, including new questions about the use of personal information by artificial intelligence systems, digital lenders, and public-sector databases. Kassait identified cross-border enforcement and Kenya's dependence on foreign technology infrastructure as areas requiring further attention. The regulator's financial penalties are limited by law to KSh 5 million or 1% of an organisation's preceding annual turnover, potentially constraining the financial consequences of violations involving large corporations.
Key points
- Immaculate Kassait exits as Kenya's Data Commissioner after overseeing the establishment of the country's privacy regulator and registration of over 15,000 data controllers and processors.
- The ODPC handled 9,061 complaints by early 2026, with enforcement measures introduced against organisations accused of misusing personal information.
- Kassait's administration gained international recognition, receiving four awards at the Global Privacy Assembly in Seoul, South Korea, in September 2025.
