The Office of the Data Protection Commissioner (ODPC) has introduced new draft guidelines to regulate data collection by private security firms in Kenya, addressing widespread and unlawful data harvesting practices. This move allows Kenyans to demand access to their personal CCTV footage and visitor log entries.

• The ODPC flagged common requirements for visitors to disclose phone numbers, home addresses, and marital status as unlawful under the Data Protection Act, 2019.
• The only information lawfully collected for basic building access is a visitor’s name, identification number, and time of entry.
• This initiative follows significant data breaches in Kenya, including a health app breach affecting 4.8 million users in October 2025 and a Business Registration Service leak impacting over two million firms in February 2025.