Kenya's Data Commissioner has published a draft public notice that would prescribe political affiliation and trade union membership as sensitive personal data, reaching information from which either can reasonably be inferred, but only for data that arrives in Kenya by cross-border transfer from a jurisdiction whose own law already treats it as sensitive

What the draft would actually prescribe

The draft opens by recording that the Data Commissioner has considered the criteria in section 47(2) of the Data Protection Act, 2019, is satisfied that the prescription is necessary for the protection of the fundamental rights and freedoms of data subjects, and acts under the power conferred by section 47(1). This draft does not establish that a final notice was made. The document is headed DRAFT and is published with an invitation to comment, so read everything below as what the notice would do if it were made.

Clause 1 would prescribe two categories: political affiliation and trade union membership. Each is drafted the same way. Political affiliation would cover "any information that reveals or relates to a data subject's political opinions, membership or affiliation with a political party or movement, participation in political activities, or any other information from which political leanings can reasonably be inferred". Trade union membership carries the mirror wording, closing on "any other information from which trade union involvement can reasonably be inferred".

Clause 3 would require data controllers and data processors to comply with the provisions of the Act and the attendant Regulations applicable to processing sensitive personal data. Clause 4 says non-compliance would attract the enforcement measures and penalties provided under the Act and those Regulations. Neither clause sets out what those requirements or penalties are, and this piece does not state them, because the draft does not.

Why the inference wording is the part to read twice

A category defined only by what a record says on its face is a records question. A category defined to include anything from which the attribute can reasonably be inferred is a different kind of question, because it turns on what can be derived rather than on what was collected. This analysis concerns the linked draft.

Segmentation, lookalike modelling, propensity scoring and behavioural targeting all produce attributes nobody was asked for. On the draft's wording, a derived score or a cluster label would be caught if political leanings or trade union involvement can reasonably be inferred from it, and it would then sit inside whatever the Act and Regulations require for sensitive personal data.

Set against that, the drafting is restrained in one respect: it says "reasonably", not "possibly". Whether a given feature set clears that threshold is a question of fact that nobody can answer in the abstract, and the draft offers no test, no example and no guidance note.

The notice never uses the words profiling, inference engine, algorithm, model, automated or artificial intelligence. The connection between this text and automated processing is our reading of what the inference clause would catch, not a statement by the Commissioner about what the clause is aimed at.

The gateway condition narrows this considerably

Clause 1 does not prescribe the two categories at large. It prescribes them "only where categorized as such in the Jurisdiction of Origin", and clause 2 then states the condition twice over: the prescription would apply only where the personal data in question is transferred to Kenya by way of a cross-border transfer, and where the originating law of the jurisdiction of origin, at the time of that transfer, treats, designates or classifies data revealing trade union membership or political affiliation, or data of equivalent character however described, as sensitive or special-category personal data.

Read plainly, that would make the status of a record depend on where it came from and on what the sending jurisdiction calls it. Two identical datasets held by the same Kenyan processor could fall on opposite sides of the line, one because it arrived from a jurisdiction with a special-category regime and the other because it was collected in Kenya.

For a group moving European or United Kingdom employee and customer data into a Kenyan shared service centre, the gateway would usually be open, since both regimes treat political opinions and trade union membership as special-category data. For a purely domestic Kenyan dataset, on the face of clause 2, it would not be.

Anyone planning against this should keep the gateway in view, not just the headline. The categories are the interesting part; the condition is the part that decides whether they touch you at all.

What the draft does not settle

The linked PDF invites comments but gives no closing date. The original report recorded an online form and public.participation@odpc.go.ke on the former HTML page. Current submission instructions have not been verified.

It gives no commencement mechanism and no transitional period. There is nothing on the page about gazettement, about when a made version would take effect, or about how data already in Kenya at that point would be treated.

It defines neither "Jurisdiction of Origin" nor "Cross-Border Transfer" within the four clauses published. Both appear capitalised, which usually signals defined terms sitting elsewhere, and the Act and its Regulations are the obvious place to look. We did not open them for this piece and so we do not state what either term covers.

And it does not say what changes operationally for a controller that finds itself holding newly sensitive data. Clause 3 routes to the Act and the Regulations without reproducing any of their requirements.

What we did not verify

The original report recorded a review of the full ODPC HTML notice, including the recital, clauses 1 to 4, feedback invitation and signature block. It recorded a September 11, 2026 publication date. During this source-link check, that HTML address returned 404. We opened the official two-page draft PDF and confirmed the quoted inference wording and cross-border conditions. We have not established that the PDF and the former HTML page were identical in every respect.

What we did not open for this source-link check: the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, which clauses 3 and 4 route to; and the four earlier ODPC guidance notes this office has issued on AI, automated decision-making, emerging technologies and privacy-enhancing technologies. We therefore do not state what obligations or penalties attach to sensitive personal data under Kenyan law, and we do not compare this draft with those notes.

What we refuse to claim: we do not say Kenya has classified inferred political data as sensitive, because the linked document is a draft and this check does not establish whether a final notice has since been made. We do not say the notice regulates profiling or AI, because it never mentions either; the connection to automated processing is our reading of the inference wording and is marked as ours in the body. The original report recorded no consultation deadline on the HTML page it reviewed. The PDF checked now contains no deadline; we have not verified a current consultation timetable. We do not say the categories apply to domestic Kenyan data, because clause 2 conditions the whole prescription on a cross-border transfer. We give no count of how many controllers this would reach, because we have no denominator.

Quotations are reproduced with ASCII punctuation in place of the typographic apostrophes and dashes used on the page, which is a house typesetting convention and not a change to any word. Where the notice separates a category name from its definition with a dash, we quote from the definition onward and do not reproduce the dash.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• Kenya's ODPC on automated decision-making and DPIAs
• Kenya ODPC Draft AI Guidance Note, July 2026
• The UK ICO on automated decision-making and profiling in recruitment
• Middle East and Africa AI regulation tracker
• AI Regulation News hub