Part of the AI Regulation News hub.
Kenya's Data Commissioner has published a draft public notice that would prescribe political affiliation and trade union membership as sensitive personal data, reaching information from which either can reasonably be inferred, but only for data that arrives in Kenya by cross-border transfer from a jurisdiction whose own law already treats it as sensitive
Eleven words in clause 1(a) do the work that matters to anyone running profiling or segmentation. They are in a draft, and the draft has no closing date on it.
Bottom line: A draft. It binds nobody. The Data Commissioner has published it for comment and the page carries no closing date, no commencement date and no transitional period, so nothing on it is in force and no clock is running.
Who this affects: Kenyan data protection officers and privacy counsel at outsourcing and data-annotation operators, HR and payroll processors, audience-segmentation and adtech vendors, and credit and insurance scoring providers that receive personal data from abroad.
Issue date: Published on the ODPC site on 11 September 2026. The page metadata records a published time of 15:14 and a modified time of 15:47 the same day. No consultation closing date is stated.
What changed: Nothing yet in law. If made, the notice would add political affiliation and trade union membership to the sensitive personal data categories, each defined to include information from which the attribute can reasonably be inferred.
Analysis: The inference wording is what carries this past a housekeeping amendment. Derived and modelled attributes are the output of profiling, and the draft's own words would place them inside the sensitive-data regime. That reading is ours; the notice does not mention profiling, models or automated processing at all.
Primary sources: DRAFT Public Notice on additional categories of sensitive personal data, ODPC
- Instrument (EN)
- Draft Public Notice of Prescription of Additional Categories of Sensitive Personal Data Pursuant to Section 47 of the Data Protection Act, 2019
- Authority
- Office of the Data Protection Commissioner, Kenya. Signed Immaculate Kassait, SC, MBS, Data Commissioner
- Jurisdiction
- Kenya, national
- Status
- Draft, published for comment. Not made, not gazetted as far as this page records, not in force
- Bindingness
- Binds nobody. Clauses 3 and 4 describe how the existing Act and Regulations would apply to data caught by clause 1; neither creates a separate duty
- Issue date / next deadline
- Published 11 September 2026. No closing date for comments is stated on the page. No commencement date is stated
- Legal basis
- Section 47(1) of the Data Protection Act, 2019, with the criteria in section 47(2)
- Document
- HTML text of the notice on the ODPC site, with a PDF download offered alongside it
- Primary source
- https://www.odpc.go.ke/draft-additional-categories-of-sensitive-personal-data/
What the draft would actually prescribe
The draft opens by recording that the Data Commissioner has considered the criteria in section 47(2) of the Data Protection Act, 2019, is satisfied that the prescription is necessary for the protection of the fundamental rights and freedoms of data subjects, and acts under the power conferred by section 47(1). None of that has happened as a legal event yet. The document is headed DRAFT and is published with an invitation to comment, so read everything below as what the notice would do if it were made.
Clause 1 would prescribe two categories: political affiliation and trade union membership. Each is drafted the same way. Political affiliation would cover "any information that reveals or relates to a data subject's political opinions, membership or affiliation with a political party or movement, participation in political activities, or any other information from which political leanings can reasonably be inferred". Trade union membership carries the mirror wording, closing on "any other information from which trade union involvement can reasonably be inferred".
Clause 3 would require data controllers and data processors to comply with the provisions of the Act and the attendant Regulations applicable to processing sensitive personal data. Clause 4 says non-compliance would attract the enforcement measures and penalties provided under the Act and those Regulations. Neither clause sets out what those requirements or penalties are, and this piece does not state them, because the draft does not.
Why the inference wording is the part to read twice
A category defined only by what a record says on its face is a records question. A category defined to include anything from which the attribute can reasonably be inferred is a different kind of question, because it turns on what can be derived rather than on what was collected. Again, in a draft that binds nobody today.
Segmentation, lookalike modelling, propensity scoring and behavioural targeting all produce attributes nobody was asked for. On the draft's wording, a derived score or a cluster label would be caught if political leanings or trade union involvement can reasonably be inferred from it, and it would then sit inside whatever the Act and Regulations require for sensitive personal data.
Set against that, the drafting is notably restrained in one respect: it says "reasonably", not "possibly". Whether a given feature set clears that threshold is a question of fact that nobody can answer in the abstract, and the draft offers no test, no example and no guidance note.
The notice never uses the words profiling, inference engine, algorithm, model, automated or artificial intelligence. The connection between this text and automated processing is our reading of what the inference clause would catch, not a statement by the Commissioner about what the clause is aimed at.
The gateway condition narrows this considerably
Clause 1 does not prescribe the two categories at large. It prescribes them "only where categorized as such in the Jurisdiction of Origin", and clause 2 then states the condition twice over: the prescription would apply only where the personal data in question is transferred to Kenya by way of a cross-border transfer, and where the originating law of the jurisdiction of origin, at the time of that transfer, treats, designates or classifies data revealing trade union membership or political affiliation, or data of equivalent character however described, as sensitive or special-category personal data.
Read plainly, that would make the status of a record depend on where it came from and on what the sending jurisdiction calls it. Two identical datasets held by the same Kenyan processor could fall on opposite sides of the line, one because it arrived from a jurisdiction with a special-category regime and the other because it was collected in Kenya.
For a group moving European or United Kingdom employee and customer data into a Kenyan shared service centre, the gateway would usually be open, since both regimes treat political opinions and trade union membership as special-category data. For a purely domestic Kenyan dataset, on the face of clause 2, it would not be.
Anyone planning against this should keep the gateway in view, not just the headline. The categories are the interesting part; the condition is the part that decides whether they touch you at all.
What the draft does not settle
It gives no closing date. The page invites comments, suggestions, observations and recommendations, offers a form, and gives public.participation@odpc.go.ke as an alternative route. It does not say when comments close, and we do not supply a date the document does not carry.
It gives no commencement mechanism and no transitional period. There is nothing on the page about gazettement, about when a made version would take effect, or about how data already in Kenya at that point would be treated.
It defines neither "Jurisdiction of Origin" nor "Cross-Border Transfer" within the four clauses published. Both appear capitalised, which usually signals defined terms sitting elsewhere, and the Act and its Regulations are the obvious place to look. We did not open them for this piece and so we do not state what either term covers.
And it does not say what changes operationally for a controller that finds itself holding newly sensitive data. Clause 3 routes to the Act and the Regulations without reproducing any of their requirements.
What we did not verify
What we opened: the full HTML text of the draft notice on the ODPC site, read end to end, including the recital, clauses 1 to 4, the feedback invitation and the signature block. The page metadata records article:published_time 2026-09-11T15:14:34+03:00 and article:modified_time 2026-09-11T15:47:19+03:00, and the visible byline reads September 11, 2026.
What we did not open: the PDF offered for download beside the HTML text, so we cannot say whether the two versions are identical; the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, which clauses 3 and 4 route to; and the four earlier ODPC guidance notes this office has issued on AI, automated decision-making, emerging technologies and privacy-enhancing technologies. We therefore do not state what obligations or penalties attach to sensitive personal data under Kenyan law, and we do not compare this draft with those notes.
What we refuse to claim: we do not say Kenya has classified inferred political data as sensitive, because this is a draft that has not been made. We do not say the notice regulates profiling or AI, because it never mentions either; the connection to automated processing is our reading of the inference wording and is marked as ours in the body. We do not give a consultation deadline, because none is published. We do not say the categories apply to domestic Kenyan data, because clause 2 conditions the whole prescription on a cross-border transfer. We give no count of how many controllers this would reach, because we have no denominator.
Quotations are reproduced with ASCII punctuation in place of the typographic apostrophes and dashes used on the page, which is a house typesetting convention and not a change to any word. Where the notice separates a category name from its definition with a dash, we quote from the definition onward and do not reproduce the dash.
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
Nothing here binds anyone today, so the useful move is a reading exercise rather than a remediation project. Take one inbound data flow from a jurisdiction with a special-category regime, and ask what your systems derive from it that a regulator could describe as information from which political leanings or trade union involvement can reasonably be inferred. If the honest answer is that nobody has ever looked, that is worth knowing while the instrument is still a draft and comments are still open.
Source File
https://www.odpc.go.ke/draft-additional-categories-of-sensitive-personal-data/
Open the notice and check four things: the DRAFT marking in the heading, the closing words of clause 1(a) on information from which political leanings can reasonably be inferred, the two limbs of clause 2 that gate the whole prescription to cross-border transfers, and the absence of any closing date or commencement date anywhere on the page.
any information that reveals or relates to a data subject's political opinions, membership or affiliation with a political party or movement, participation in political activities, or any other information from which political leanings can reasonably be inferred. ยท Draft Public Notice on additional categories of sensitive personal data, clause 1(a), 11 September 2026
FAQ
Is inferred political data now sensitive personal data in Kenya?
No. This is a draft public notice published for comment. It has not been made, it is not in force, and it binds nobody. If it were made in its current form, clause 1(a) would bring information from which political leanings can reasonably be inferred inside the sensitive-data categories.
Would it apply to data we collected in Kenya?
On the face of clause 2, no. The prescription would apply only where the data is transferred to Kenya by way of a cross-border transfer and the originating law already treats political affiliation or trade union membership as sensitive or special-category data.
Does the notice regulate profiling or AI systems?
It does not mention profiling, models, automated processing or artificial intelligence anywhere. The connection is the inference wording in clause 1, which on our reading would reach derived attributes. That is our characterisation, not the Commissioner's.
When do comments close?
The page does not say. It invites comments, suggestions, observations and recommendations through an on-page form or via public.participation@odpc.go.ke, and states no closing date. We do not supply one.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.