Technical and Vocational Education and Training (TVET) institutions in Kenya have been called upon to enhance their data protection measures to ensure the secure handling, storage, and sharing of information. This call was made during a recent data protection and governance workshop that brought together stakeholders from TVET institutions, the government, and the Office of the Data Protection Commissioner (ODPC). The workshop aimed to discuss the importance of data protection and governance in the TVET sector.
Dr. Reuben Lang'at, a lecturer at the University of Kabianga, emphasized that TVET institutions must establish clear protocols governing the movement of data between Boards of Governors, government, and institutions. He noted that boards of governors play a crucial role in receiving information from the government and relaying institutional data through appropriate channels. Lang'at also stressed that stakeholders must clearly establish who is authorized to receive information, when it should be shared, and the specific purpose for sharing it.
According to Dr. Lang'at, compliance with the Data Protection Act, 2019, should not be viewed as a one-off exercise, but rather as an ongoing process. He noted that registration with the ODPC alone does not amount to full compliance. Institutions are also required to conduct Data Protection Impact Assessments on their systems and develop formal policies governing the management of personal information. Lang'at urged participants to become "data champions" who would return to their respective institutions and sensitise trainers, administrative staff, and students on data protection.
The TVET sector is rapidly embracing digitalization, and data protection has become a critical aspect of this process. Lang'at described data as both numerical and non-numerical information, including names, identification numbers, and telephone contacts. He warned that exposure of personal information could facilitate fraud, impersonation, and unauthorized monitoring of individuals. He also noted that digital devices and third-party software can create risks if institutions do not understand who has access to information and how that access is controlled.
Shadrack Tonui, Chair of the Kenya Association of Technical Training Institutions (KATTI), called for closer coordination between TVET institutions, professional bodies, and the State Department in handling sensitive information. He expressed concern over sensitive institutional documents, including staff records, ministry memoranda, and recruitment directives, reaching the public before official release. Tonui also urged greater standardisation of training programmes to reduce costs and ensure that certificates earned by participants contribute towards Continuing Professional Development points.
John Okowi of the Office of the Data Protection Commissioner reminded participants that the right to privacy is protected under Article 31 of the Constitution and that the Data Protection Act, 2019, provides the main legal framework for handling personal information. He said the ODPC is responsible for registration, compliance audits, investigations, enforcement, and public awareness, urging TVET institutions to strengthen their systems as they continue with digital transformation.
The data protection and governance workshop was held on September 24, 2026, and was attended by stakeholders from TVET institutions, the government, and the ODPC. The workshop aimed to raise awareness about the importance of data protection and governance in the TVET sector and to provide guidance on how to implement effective data protection measures. Key recommendations from the workshop included the establishment of Data Governance Committees with defined membership and terms of reference.
Key points
- TVET institutions in Kenya must strengthen their data governance systems to safeguard personal and institutional information amid the rapid shift to digital government services.
- The Data Protection Act, 2019, provides the main legal framework for handling personal information in Kenya.
- TVET institutions are required to conduct Data Protection Impact Assessments on their systems and develop formal policies governing the management of personal information.
