Kenya’s data protection regulator has published new draft guidance on biometric data processing and children’s data protection, signaling a major policy shift in how sensitive personal data must be handled by organizations operating in the country. The Office of the Data Protection Commissioner (ODPC) released both documents for public consultation on May 16.
Biometric Processors Face Stricter Requirements
Under the new draft framework, any organization processing biometric data must register with the ODPC and demonstrate that the data collection is both necessary and proportionate. The guidance outlines strict requirements for security, purpose limitation, and lawful processing, particularly in cases involving facial recognition, fingerprinting, and other biometric modalities. These efforts come in response to heightened public scrutiny of biometric programs, including recent controversy surrounding World ID’s data practices in Kenya.
The ODPC has also demonstrated a willingness to enforce existing rules. In September 2023, the regulator issued fines totaling KES 9,375,000 for data privacy violations, including penalties against a school that published photos of minors without obtaining parental consent.
Children’s Data Guidance and Age Verification Proposals
Alongside the biometric guidance, the ODPC released a draft note focused on the protection of children’s data. While the ODPC guidance does not mandate age verification by a specific date, it recommends that platforms offering digital services to minors implement privacy-by-design principles and limit the collection of personal data to what is strictly necessary.
Separately, the Communications Authority of Kenya (CA) has proposed more concrete rules under a draft framework titled “Industry Guidelines for Child Online Protection and Safety.” The proposal, still under review, suggests that online platforms may be required to implement ID-based age verification mechanisms by October 2025. The CA has indicated that platforms could begin by accepting self-declared ages, but that full verification would eventually be required for certain services involving minors.
The CA proposal discourages blanket ID checks for low-risk services, advocating instead for a “safety by design” approach that balances age assurance with data minimization. This would potentially make Kenya one of the first countries to formally recommend ID verification for social media access, although the framework has not yet been finalized or enforced.
If adopted, these new requirements could significantly impact a broad range of entities, from social media platforms and telecom operators to device manufacturers, broadcasters, and content providers. Organizations would have until October 2025 to bring their platforms into compliance.
Sources: Tech-ish, DataGuidance
—
May 22, 2025 – by Ali Nassar-Smith
