Discussion Paper No. 320 of 2023 on Building Personal Data Sovereignty in Kenya

Abstract

Abstract Personal data is an invaluable strategic resource for businesses and governments that drives economic growth and development. The ability to collect and use large volumes of personal data in an efficient manner has become an important component in today’s data-driven world. However, in the digitally disruptive age of the Internet, involving unrestricted and unregulated processing of personal data outside a given jurisdiction popularly known as cross-border data transfers have raised concerns of privacy, trust, and sovereignty across many countries. Consequently, countries are seeking to reinstate their sovereignty over gaining control and use of personal data by embracing Data Localization measures. This paper seeks to appraise policy efforts for safeguarding the personal data sector against increasing privacy and security-related threats with a goal of building data sovereignty in Kenya. The paper applied exploratory approach guided by OECD data governance framework that comprised of three pillars: Strategic pillar; Tactic pillar; and Delivery pillar. A systematic review of secondary sources of information including policy and legal documents drawn from local and international scene was carried out. Overall, Kenya’s data localization regulations are less strict, not fully implemented and are barely three years old.