Kenya has picked a new head for its data privacy watchdog, but Parliament has the last word. President William Ruto nominated Lydia Sitienei Chelagat as Data Commissioner on Monday 9 November 2026, and the name has gone to the National Assembly.
For US readers, the post matters because the Data Commissioner polices how any company, local or foreign, handles the personal data of people in Kenya. That covers banks, mobile-money services, tech platforms and AI tools that serve a major digital market in East Africa.
What Happened
Government spokesperson Charles Owino announced the nomination on Monday 9 November 2026. He said the president acted on the recommendation of the Public Service Commission, the state body that recruits for senior public posts.
The same announcement named five new chief executives for state corporations. Their boards appointed them after competitive recruitment, a separate process from the Data Commissioner nomination.
Chelagat most recently served as Corporation Secretary and Director of Legal Services at the Communications Authority of Kenya, the telecoms regulator. The recruitment drew 152 applications for the post.
Who She Would Replace
Immaculate Kassait has led the Office of the Data Protection Commissioner, Kenya’s privacy regulator, since November 2020. The Data Protection Act of 2019 gives the commissioner a single term of six years with no right to be reappointed.
Kassait’s term is ending because the law bars reappointment. Her successor can take over only after the National Assembly gives its approval.
The Parliament Buildings in Nairobi, seen from the street. Photo: Jorge Láscar, via Wikimedia Commons, CC BY-SA 2.0.How the Process Works
Under the Data Protection Act, the president nominates the commissioner and appoints her with the approval of the National Assembly. The nomination has been forwarded to the assembly for consideration.
Lawmakers normally vet nominees in a committee and then vote in the full house. No date for that hearing has been announced.
Kassait took office in November 2020, so her six-year term runs out this month. That puts the vetting of her successor on a short clock, because the office needs a confirmed leader soon after.
What the Office Does
The Office of the Data Protection Commissioner enforces the Data Protection Act of 2019, Kenya’s main privacy law. The act lets the commissioner investigate complaints and take enforcement action against organisations that break it.
Banks, telecoms companies, hospitals, online lenders and government agencies all hold large amounts of personal data. The commissioner decides how that data may be collected, stored and shared.
What It Means for You
If your company handles data of people in Kenya, the commissioner decides how strictly the 2019 law is enforced. That includes complaints, audits and action against firms that mishandle personal information.
Travellers and expats should see no immediate change, because the law stays the same. The nomination matters most for tech, finance and health firms that move Kenyan customer data abroad, since the law sets rules for sending personal data abroad.
What Is Not Known
It is not known when the National Assembly will hold the hearing or whether it will approve the nominee. The government has given no timetable for the hearing.
Chelagat has not yet set out her priorities in public. Lawmakers have given no signal on timing.
More: Kenya news in English