Kenya's ODPC Drafts a One-Border Rule for Political and Union Data

Kenya's data protection regulator has drafted a rule that sounds sweeping and reads narrow. On 11 September 2026, the Office of the Data Protection Commissioner (ODPC) published a draft public notice under section 47(1) of the Data Protection Act, 2019, prescribing political affiliation and trade union membership as additional categories of sensitive personal data. Public comment closed on 25 September 2026.

Most coverage stopped at the headline: Kenya is about to treat political opinions and union membership like health records. That is half right. Read at source, the draft notice does something more specific — and the specifics matter for anyone running HR, payroll, or screening systems that touch data from abroad.

The scope is one border, not the whole country

Clause 2 of the draft notice sets the real boundary. The prescription applies only where personal data is transferred to Kenya by way of a CrossBorder Transfer — and only where the Originating Law of the jurisdiction of origin already treats political affiliation or trade union membership as sensitive or special category data at the time of transfer.

Data collected inside Kenya is untouched. A Nairobi campaign firm building a supporter database from local sign-ups is operating under the existing Data Protection Act, not the new classification. A multinational running its group-wide HR platform out of Frankfurt and replicating employee records — including union membership — into a Kenyan server is squarely inside the new rule, because GDPR Article 9 already classifies both categories as special category data.

In effect, the notice creates a classification floor on imported data: whatever the sending jurisdiction already protects as sensitive, Kenya will treat as sensitive on arrival.

Three terms the Act does not define

Here is where the drafting gets interesting. The notice's three operative terms — CrossBorder Transfer, Originating Law, and Jurisdiction of Origin — appear nowhere in the Data Protection Act. The Act's Part VI (sections 48 and 49) governs transfers out of Kenya. There is no inbound-transfer regime in the statute for these terms to anchor to.

That is not a stylistic quirk. Undefined operative terms in a prescription notice create an interpretation gap that lands on data controllers and processors first, and on the ODPC's enforcement docket later. What counts as a "CrossBorder Transfer" — a cloud replication, a backup restore, a support engineer's screen share, an API sync? What is the "Originating Law" when data transits two jurisdictions before arrival? The notice does not say, and the Act cannot help.

Regulated organisations will have to make a defensible call on each of these before the notice is gazetted in final form — and the conservative answer (treat any inbound replication of EU-origin political or union data as in-scope) is also the operationally expensive one.

Who is exposed

The practical exposure set is narrower than "everyone with data," but deeper than it first appears:

• Multinationals importing HR and payroll data from EU or GDPR-style jurisdictions, where group employee records include union membership


• Recruitment and screening firms pulling candidate history from abroad


• Insurers and due-diligence providers ingesting foreign sanctions, adverse-media, or political-exposure datasets


• Whistleblowing platforms whose case management systems are hosted or replicated outside Kenya


• Campaign and election-adjacent vendors — with the 2027 general election approaching, any imported targeting or modelling data that encodes political affiliation

For each of these, the arrival of EU-origin political or union data into Kenya would now carry sensitive-data obligations: the higher lawful-processing bar under section 30 of the Act, and the enforcement consequences that attach to sensitive data.

The compliance floor arrives with teeth

Non-compliance does not route into a new penalty schedule — it routes into the Act's existing ones, and they are not gentle:

• Up to KSh 5 million or 1% of preceding-year turnover for breaching core data-protection obligations (section 63)


• KSh 5 million or two years' imprisonment for breaching an enforcement notice (section 58(3))


• KSh 3 million or ten years' imprisonment under the general penalty provision (section 73)

The classification itself is the multiplier. Once political affiliation and trade union membership are sensitive, the processing standard rises, the consent quality required rises, and every downstream breach is measured against a stricter baseline.

The GDPR convergence, in one direction

The substance of the notice tracks GDPR Article 9: political opinions and trade union membership are special category data in Europe precisely because they enable persecution and discrimination. Kenya's draft adopts the same two categories, and the same protection logic — but applies them at the border rather than universally.

That makes this a convergence instrument: Kenya aligning its sensitive-data list with its major trading partners' for data that crosses into the country, without extending the same classification to domestically collected data. The asymmetry is deliberate. It keeps the compliance burden on importers rather than on the domestic political and labour ecosystem.

Whether that asymmetry survives the final gazetted text — or a future notice extends the classification to local data — is the question organisations should be asking now, not after the penalty letters start.

What to do before gazettement

The comment window has closed, which means the text is close to final. Organisations with inbound data flows from GDPR jurisdictions should, in order:

• Map inbound flows — identify every system that replicates or receives personal data from the EU and comparable jurisdictions, and flag any fields touching political affiliation or trade union membership


• Inventory the undefined terms — document how your organisation interprets CrossBorder Transfer, Originating Law, and Jurisdiction of Origin, and make the interpretation consistent across systems


• Reclassify early — apply sensitive-data handling (section 30 lawful basis, higher consent standard, breach-notification priority) to flagged inbound data before the notice is gazetted, not after


• Watch for the final text — any movement on the three undefined terms between the draft and the gazetted notice changes the scope of everything above

The narrow reading is the accurate one: this is not Kenya declaring political and union data sensitive everywhere. It is Kenya declaring that such data does not lose protection by crossing the border. For importers, that is still a live compliance project — with a KSh 5 million floor and a ten-year ceiling attached.