If you’ve been scanning Kenyan tech news or WhatsApp groups recently, you might have caught wind of a headline that sounds straight out of a dystopian thriller: The Kenyan government is planning to sell eCitizen data.
Given how central eCitizen has become to our daily lives—housing everything from our driving licences and business registrations to passport applications and land titles—it is completely natural to feel a sudden spike of alarm. Is the state really about to auction off our private information to the highest bidder?
The short answer is no, not your personal info. But the longer answer introduces a massive, multi-million-shilling policy shift that every Kenyan citizen, entrepreneur, and tech enthusiast needs to understand.
Let’s break down exactly what the Ministry of Information, Communications and the Digital Economy (MICTDE) has proposed in its Draft Final National Data Governance Policy, and what it actually means for your privacy.
The Core Plan: Data as a “Strategic National Asset”
The Kenyan government isn’t selling your name, phone number, or National ID. Instead, it is treating public data as an untapped economic resource.
The state is establishing a formal, state-run digital marketplace designed to package and license non-personal, anonymised, and aggregated datasets to businesses, researchers, NGOs, and innovators.
Overseen by a proposed new body—the National Data Governance and Emerging Technologies Council—the government intends to roll out at least 1,000 datasets over the next five years. Setting up this infrastructure is projected to cost around Sh396 million, but the state expects it to open up a lucrative new revenue stream for the exchequer.
What is Actually Up for Sale?
Think of this as “macro-level” data. The marketplace aims to sell structural trends and statistics generated across various state platforms:
- Business & Commerce: Registration volumes, sector growth rates, and regional investment trends pulled from eCitizen registries.
- Transport & Logistics: Vehicle registration statistics, vehicle types (like the shift toward hybrids or EVs), and traffic flow patterns.
- Immigration: Passport and visa application volumes broken down by region or demographics.
- Agriculture & Real Estate: Regional crop production figures, land transaction volumes, and mapping data.
The Legal Firewall: What is NOT Being Sold
The most critical distinction to make here is between personal data and non-personal data.
Under Kenya’s Data Protection Act (2019), the government is legally prohibited from selling your private, identifying information. The new draft policy explicitly reinforces this boundary.
Strictly Off the Table: Names, phone numbers, email addresses, National ID numbers, KRA PINs, biometric data, and personal images will not enter the marketplace.
For instance, a logistics company won’t be able to buy a list of who owns commercial trucks in Nairobi. However, they will be able to buy a dataset showing that truck registrations in Nairobi increased by 15% last quarter.
Why is the Government Doing This?
While it might sound unusual, Kenya is actually taking a page out of the global tech playbook. The policy framework draws inspiration from countries like Singapore and the United Kingdom. For example, the UK’s Ordnance Survey generates over Sh34 billion annually by licensing state-owned geospatial and mapping data to private entities.
By monetizing public records in a structured way, Kenya is targeting three major goals:
- A Fresh Revenue Stream: Rather than sitting on mountains of administrative data, the government wants to turn it into a commercial product to help fund public services.
- Feeding the AI Boom: Kenya’s artificial intelligence sector is currently valued at roughly Sh31 billion, and the local data center market is projected to attract over Sh104 billion in investments by 2031. AI models and tech infrastructure require massive amounts of clean, structured data to train on. This marketplace provides the fuel.
- Cleaning Up Government Systems: Right now, state data is fragmented, messy, and siloed across different ministries. This policy forces agencies to clean, standardize, and centralize their data into a single “source of truth.”
The Big Catch: Why Privacy Advocates Are Wary
Even though the policy looks solid on paper, data privacy analysts and legal experts have raised immediate flags. The primary concern boils down to a technical vulnerability known as re-identification risk.
Even if a dataset is completely stripped of names and ID numbers, it is surprisingly easy to reverse-engineer anonymity. If a private company buys an “anonymised” transport dataset, cross-references it with a public land registry dataset, and layers on some basic social media scraping, they can frequently re-identify specific individuals.
As it stands, the draft policy hasn’t fully detailed the precise technical safeguards, cryptographic standards, or punitive legal liabilities that will prevent buyers from pulling off this kind of data stitching.
The Bottom Line
Kenya is attempting to transition from a country that simply collects data to a country that capitalizes on it. If executed with ironclad security, it could catalyze local tech innovation, improve corporate decision-making, and give the exchequer a boost.
But when the state decides to treat public information as a commercial asset, the margin for error shrinks to zero. As the rollout begins later this year, the real test won’t be how much revenue the marketplace generates, but how fiercely the Office of the Data Protection Commissioner (ODPC) protects the firewall between bulk trends and our private lives.