President William Ruto has nominated Lydia Sitienei Chelagat as Kenya's next Data Protection Commissioner, marking the first leadership transition at the Office of the Data Protection Commissioner (ODPC) since its establishment. Chelagat, currently the Director of Legal Services and Corporation Secretary at the Communications Authority of Kenya (CA), was nominated on November 9, 2026. Her appointment follows a competitive recruitment process that attracted 152 applicants.
Chelagat is expected to succeed Immaculate Kassait, Kenya's inaugural Data Protection Commissioner, who has completed her six-year, non-renewable term. During Kassait's tenure, the ODPC introduced registration requirements for qualifying data controllers and processors, established complaints and investigations mechanisms, and began imposing administrative penalties against organisations found to have violated data protection laws. The ODPC also supervised the deletion of biometric data unlawfully collected by Worldcoin.
Chelagat brings legal and regulatory experience from the Communications Authority, where she has been since December 2023. She has over 15 years of experience in legal services, corporate governance, and regulatory affairs. Previously, she served as General Manager of Legal Services and Company Secretary at the Kenya Electricity Transmission Company (KETRACO) and as Group Company Secretary and Head of Legal Services at CPF Financial Services.
The ODPC was established under the Data Protection Act, 2019, to regulate the processing of personal data, protect individuals' privacy rights, and enforce compliance among organisations handling personal information. The regulator has grown significantly, with over 15,000 registered data controllers and processors, and an expanding enforcement mandate covering various sectors, including financial institutions, telecommunications companies, and healthcare providers.
Chelagat's nomination was made on the recommendation of the Public Service Commission (PSC), according to Government Spokesperson Charles Owino. The nomination has been transmitted to the National Assembly for consideration, in fulfilment of the legal requirements set out under the Data Protection Act. If approved, Chelagat will take charge of a regulator facing increasingly complex questions surrounding artificial intelligence, biometric identification, and digital financial services.
The incoming commissioner will be responsible for enforcing Kenya's data protection legislation, investigating privacy complaints, and supervising compliance by public and private institutions. Chelagat will also inherit questions about the regulator's ability to enforce decisions against multinational technology companies and strengthen cross-border data protection arrangements. Her appointment is subject to vetting and approval by the National Assembly.
Under the Data Protection Act, the commissioner serves a single, non-renewable six-year term. Chelagat holds a Bachelor of Laws degree from the University of Buckingham in the United Kingdom and a master's degree in Public Policy and Management from Strathmore University Business School. The National Assembly must now consider Chelagat's nomination before she can formally assume office, with the transition expected to shape Kenya's approach to data privacy regulation over the next six years.
Key points
- Lydia Chelagat has over 15 years of experience in legal services, corporate governance, and regulatory affairs.
- The ODPC has grown significantly, with over 15,000 registered data controllers and processors.
- Chelagat's appointment is subject to vetting and approval by the National Assembly.
