Kenya Wants To Monetise Citizen Data, But The Privacy Advocates Aren't Buying the Assurances

John Tanui sat through a government workshop and said the quiet part out loud: the goal was never just to sell data, it was to build new businesses from it. That distinction matters to officials inside Kenya's Ministry of Information, Communications and the Digital Economy.

To the privacy advocates and legal experts now pushing back, it sounds like a technicality standing between the state and a new revenue line built on information citizens never chose to hand over for commercial use.

Under a draft National Data Governance Policy, Kenya plans to make up to 1,000 anonymised government datasets available for commercial use over the next five years.

Businesses, researchers, NGOs, and innovators would access the data through subscription models, licensing arrangements, and data-as-a-service offerings, the kind of infrastructure more commonly associated with private analytics firms than with a national government.

If it moves forward as planned, Kenya would become one of the first African countries to formally commercialise public-sector data at this scale, treating the information its citizens generate through ordinary civic life as a strategic economic asset.

A Marketplace Built From Mandatory Data

The datasets under consideration come from platforms Kenyans interact with because they have no real alternative. eCitizen, the government's digital services portal, sits at the centre of the plan, alongside other public systems that capture business registration trends, vehicle registration statistics, agricultural production patterns, traffic flows, and demand for government services across regions.

None of this data was submitted with a commercial marketplace in mind. A farmer reporting crop yields to an agricultural officer, a driver renewing a vehicle license, a small business owner filing registration paperwork: each interaction was a condition of participating in the formal economy, not a transaction with an implied resale clause attached.

Officials maintain that the commercial offering will exclude personally identifiable information entirely. Names, phone numbers, national ID numbers, and images will not be part of any dataset sold or licensed under the marketplace, according to the ministry's framing of the proposal.

Tanui has been explicit that the state does not see itself as selling data in the way the phrase usually implies. The value, he argues, lies downstream, in the products, businesses, and innovation that become possible once researchers and companies can work with large, structured datasets they currently cannot access.

The fiscal motivation behind the timing is hard to separate from the policy itself. Kenya has spent recent years navigating widening budget pressures, and a data marketplace offers a path to new state revenue that doesn't require new taxes or fresh borrowing.

The proposal frames data the way previous governments framed extractive resources, as something the state already holds in abundance and has simply failed to monetise.

Why Anonymisation Doesn't Settle the Argument

Privacy researchers have spent more than a decade demonstrating that anonymised data is rarely as anonymous as it looks once it leaves its original context. Strip the names from a dataset and the dataset can often still be unmasked through cross-referencing.

Combine a traffic flow dataset with a business registration dataset and a regional services dataset, and patterns emerge that narrow down who and where the data actually describes.

This isn't a fringe academic concern. Re-identification through dataset triangulation has been documented repeatedly across health records, location data, and consumer behaviour data in multiple countries, and it is the first risk any credible data scientist checks before declaring a dataset safe for release.

That risk sits underneath every assurance Kenyan officials have offered so far. The government has said personal identifiers will not be included, but it has not detailed the technical standards that will govern how aggregation and anonymisation are verified, audited, or stress-tested against re-identification attempts.

Legal experts and civil society groups have raised exactly this gap, alongside broader questions about surveillance risk, data governance structures, and whether the consent embedded in mandatory government services can reasonably extend to commercial resale of the information those services generate.

Kenya's Office of the Data Protection Commissioner has built a more assertive regulatory posture in recent years, pushing for transparency and accountability as the country's digital systems have expanded.

Whether that office will hold meaningful authority over a data marketplace run by a different ministry, with its own revenue incentives, remains an open question the draft policy has not resolved.

The Questions the Policy Hasn't Answered

Beyond the privacy debate sits a set of practical questions that will determine whether the marketplace functions as intended or collapses under its own ambiguity. Pricing remains undefined: there is no public framework for how a dataset built from eCitizen activity gets valued, or who decides what a business should pay to license traffic flow data for a specific region. Ownership is similarly unclear.

Citizens generated the underlying activity, the government holds and structures the data, and private companies would extract commercial value from it, a chain that raises an obvious question about who actually owns the asset being sold.

Oversight carries the same uncertainty. No public detail has emerged on which body will audit datasets before release, how violations would be penalised, or how revenue collected through the marketplace would be tracked and allocated once it reaches state accounts.

A policy built around commercialising public trust requires governance mechanisms that move at least as fast as the commercial ambition driving it. Right now, the ambition is ahead.

What’s Changed Since the Draft Went Public

There is no sign President William Ruto has reversed course or distanced himself from the marketplace plan. If anything, the policy has moved forward and gained more definition. The public participation window for the draft closed on June 5, and implementation is expected to begin as early as July, starting with a phased approach focused on standards and capacity building rather than an immediate full launch of dataset sales.

The policy now has an official name and an author behind it. It is the Draft Final National Data Governance Policy, dated May 2026, and Cabinet Secretary William Kabogo Gitau wrote its foreword, describing data as no longer merely a by-product of transactions but a strategic national asset capable of strengthening governance and accelerating inclusive growth.

A specific oversight structure has also been named. The National Data Governance and Emerging Technologies Council will chair the process, led by the Principal Secretary for ICT, supported by a Data Governance Office within the ministry and data officers placed in every ministry, agency, and county government. That answers part of the accountability question critics raised, though it does not resolve whether a council chaired by the same ministry driving the revenue plan can act as a genuine check on it.

A cost figure has also entered the public record. Building and running the marketplace over five years is estimated at roughly $3.07 million, or about Ksh396 million, a number that frames the scale of the state’s financial commitment to the project regardless of how the privacy debate resolves.

Separately, Ruto has been personally active on a related front. In Brussels in June, he led talks with European Union officials toward a Data Adequacy Decision that would ease cross-border transfer of personal and commercial data between Kenya and EU member states, with new EU financial commitments tied to Kenya’s digital transformation agenda.

That push is not the same policy as the domestic data marketplace, but it points the same direction: an administration leaning further into data as economic strategy, not pulling back from it.