ACAIGO's Comments on ODPC's Draft Public Notice on additional Categories of Sensitive Personal Data

On 11 September 2026, the Office of the Data Protection Commissioner (ODPC) published the Draft Public Notice of Prescription of Additional Categories of Sensitive Personal Data Pursuant to Section 47 of the Data Protection Act, 2019. The ODPC invited comments, suggestions, observations and recommendations from members of the public and relevant stakeholders.

The Draft Public Notice proposed the recognition of the following categories of personal data as sensitive personal data, but only where they were categorised as such in the jurisdiction from which the data originated:

Political affiliation: Information that reveals or relates to a data subject’s political opinions, membership of or affiliation with a political party or movement, participation in political activities, or any other information from which the data subject’s political leanings can reasonably be inferred.

Trade union membership: Information that reveals or relates to a data subject’s membership of, affiliation with or activities in a trade union or labour organisation, or any other information from which the data subject’s trade union involvement can reasonably be inferred.

Under the Draft Public Notice, the proposed prescription would apply only where:

1. the personal data was transferred to Kenya through a cross-border transfer; and

2. at the time of the transfer, the law of the jurisdiction from which the data originated treated, designated or classified political affiliation or trade union membership or data of an equivalent character as sensitive personal data or special-category personal data.

On 18 September 2026, the African Centre for AI Governance and Oversight (ACAIGO) submitted comments on the Draft Public Notice.

ACAIGO welcomed and supported the ODPC’s intention to strengthen the protection afforded to personal data revealing political affiliation and trade union membership. However, ACAIGO expressed concern that the proposed prescription would apply only where personal data was transferred to Kenya from a jurisdiction that already categorised political affiliation or trade union membership as sensitive or special-category personal data.

In ACAIGO’s view, the risks identified in the Draft Public Notice were not unique to data subjects whose personal data was transferred from such jurisdictions. Kenyan data subjects and other individuals whose data was collected within Kenya were equally susceptible to discrimination in employment, political targeting, intimidation and reputational harm arising from the misuse or unauthorised disclosure of their political affiliation or trade union membership.

The proposed prescription could therefore result in unequal levels of protection for equivalent personal data processed in Kenya. Personal data transferred from jurisdictions that classified political affiliation and trade union membership as sensitive would receive greater protection than equivalent data collected in Kenya or transferred from jurisdictions that do not recognise these categories as sensitive.

ACAIGO therefore invited the Data Commissioner to prescribe political affiliation and trade union membership as sensitive personal data irrespective of the jurisdiction from which the data originated.