After six years at the helm of the Office of the Data Protection Commissioner (ODPC), Immaculate Kassait is set to leave the position officially as Data Commissioner, come November 16, 2026.
Being Kenya’s first data protection czar, she opens up about the role she played in setting off data protection and data privacy discourse especially to the public.
“I think we’ve made data protection a conversation in this country. I think for me, that’s what I’m most proud of, and strategically placing Kenya globally, but more importantly, holding data controllers accountable, that they can no longer just take people’s data and use it as they like,” she says.
Speaking during a stakeholder engagement with the ODPC, Advocate Dr Laibuta Mugambi said operationalization of the office has brought about liberty to users on how their data can be used by those who are held responsible.
“There is a level of appreciation because the Data Commissioner and a lot of stakeholders even using community radio, content creators talking about data protection, talking about cybersecurity and that kind of thing,” he said.
He went on, “So there is a level of appreciation that there is a point where you and I will drop the ball for whatever reason. The reason may be personal, the reason may be financial and hat is one of the question that what data are agreeable to lose and why are you agreeable to lose that data.”
Kenya has been consistently ranked higher in Africa and globally in data protection following the enactment of the Data Protection Act in 2019.
The act which requires registration of data controllers and data processors has also enabled companies processing the data to be transparent and accountable.
According to Privacy Scorecard Report 2025 by Unwanted Witness, Kenya registered the highest privacy compliance rate of 46%, with Nigeria, Uganda, Mauritius and Ghana achieving a score of 44%, 43%, 40% and 36% respectively.
During her tenure, Kassait says despite pushbacks in regards to complaints lodged before it, the office has been able to prosecute cases data privacy breached occurred with no backlogs.
It is during her tenure that for the first time, individuals, entertainment joints, hospitals and other public entities have either been fined or received warning over consumer data misuse.
“But increasingly, we are seeing pushback from members of the public who at times don’t take no for an answer, and at times when they are dissatisfied, they still go to court. They still want us to take that matter, even when it falls outside our jurisdiction,” she says.
However according to Kassait, while data privacy concerns continue to gain traction, there is need for Kenya to establish a data pool to spur innovation.
She says Kenya needs to consider digital public infrastructure where innovators can access data which is used in to improve and develop systems and applications.
“There should be a pool of data that is not used perhaps for commercial purposes, but is helped to improve processes, that is centrally held. And that way, it’s anonymised, doesn’t necessarily have my personal data. So that’s what the world is moving towards, in terms of making the data governance infrastructure a more accountable space,” she advises.
While Artificial Intelligence adoption also continued impact data privacy protection, Kassait says ODPC has since issued a guidance note to keep up with the evolution of the technology.
“That guidance note tells you what are the uses for AI, what are the do’s and what are the don’ts, why you should tell controllers as you’re beginning to collect the information, what is it for, that’s what we have done to guide them,” she notes.
With her potential successor Lydia Sitienei having been nominated as the next Data Commissioner pending parliamentary approval, Kassait says Kenya still need reforms in the operations of the office as well as seeing through the ratification of the Malabo Convention.
Kassait who is currently pursuing cybersecurity also expects to launch her much anticipated autobiography titled next year as she ponders her next move.
