As Kenya gradually shifts into election mode, another campaign season is taking shape behind the scenes. The Office of the Data Protection Commissioner (ODPC) has issued Guidance Notes for Electoral Purposes, setting out how personal data should be collected, processed and protected throughout the electoral cycle. The guidance comes as political parties, candidates, campaign teams and electoral institutions increasingly rely on digital platforms, voter databases and targeted communication to engage the electorate. 

While the document is technical, its underlying message is straightforward: electoral competition does not exempt organisations from complying with Kenya’s data protection laws. The guidance is therefore less about creating new obligations than about clarifying how the Data Protection Act, 2019 applies before, during and after elections.  

Elections Run on Data  

Since modern elections rely on information, political actors regularly handle large amounts of personal data, including voter registration records, party membership details, information on campaign volunteers, and the results of opinion polls and digital outreach activities. Likewise, electoral institutions keep and maintain voter registers, some of which include biometric information used to verify voters at polling stations. 

The ODPC notes that this growing reliance on personal information makes elections one of the most data-intensive activities undertaken by public institutions and political organisations. As a result, protecting voters’ privacy has become an essential component of maintaining confidence in the electoral process. 

The guidance therefore applies not only to the Independent Electoral and Boundaries Commission (IEBC) but also to political parties, the Office of the Registrar of Political Parties, civil society organisations, election observers, volunteers, and any other election stakeholders involved in collecting or processing voter information.  

The Rules Do Not Change During Elections  

One of the clearest messages in the guidance is that electoral activities remain subject to the same data protection principles that govern every other sector. 

Personal data should be obtained lawfully, processed fairly and transparently, used only for the purposes specified at the time of collection, kept accurate, retained only for as long as necessary, and protected against unauthorised access or misuse. Moreover, organisations are expected to demonstrate accountability by incorporating privacy protections into their operations from the outset.  

For political parties and campaign teams, this means voter information cannot be collected merely because it may prove useful during an election. There must be a lawful basis for processing that information, and organisations must be able to explain why the data is being collected, how it will be used and with whom it may be shared. 

The guidance emphasises that where consent is relied upon, it must be freely given, specific, informed and unequivocal, with the burden of proving consent resting on the data controller.  

Balancing Privacy and Public Interest  

The guidance also draws an important distinction between data collected under statutory mandates and data collected for political engagement. For example, the IEBC processes voter information because electoral laws require it to compile and maintain the Register of Voters. Similarly, political parties are required by law to maintain membership registers and submit them to the Office of the Registrar of Political Parties. 

These legal requirements provide a lawful basis for processing certain types of personal data. However, this lawful basis does not cover all aspects of political campaigning. If organisations collect any personal information beyond what is required by statute, they must establish an appropriate lawful basis under the Data Protection Act, which may require obtaining consent where necessary.  

Digital Campaigning Under Greater Scrutiny  

The most important point about the guidance is that it recognises how political communication has changed. Nowadays, campaigns tend to use digital advertising, voter profiling and data-driven outreach to reach specific audiences. Although these methods offer new opportunities for engagement, they also raise significant questions about transparency and fairness.  

The ODPC reminds electoral stakeholders that voters have the right to know how their personal information is used. Individuals also have the right to access their data, request the correction of inaccurate information, and object to certain forms of processing. Importantly, the guidance highlights that when voters receive automated political advertising or profiling, they should be informed why they are being targeted. 

The document also reiterates that personal data collected for one purpose should not be repurposed for unrelated political activities without an appropriate legal basis.  

Stronger Governance, Not Just Compliance  

In addition to their legal duties, the guidance urges electoral stakeholders to strengthen their internal governance of personal data. The ODPC suggests that organisations should review their data processing activities, update their privacy notices, carry out Data Protection Impact Assessments (DPIAs) where processing involves high risks, provide training for both permanent staff and campaign volunteers on their privacy obligations, and establish procedures for detecting and responding to data breaches. It is also advised that electoral stakeholders ensure that any third-party service providers who handle voter information adhere to the same confidentiality and security standards required by law.  

These recommendations reflect an increasingly preventive approach to regulation, in which compliance is expected to be embedded within organisational systems rather than addressed only after problems arise.  

Why It Matters  

The guidance arrives well ahead of the next General Election, giving political parties, electoral institutions and campaign organisations time to strengthen their data governance frameworks before campaign activity intensifies.  

For political organisations, compliance has become a matter of public trust. As elections become increasingly digital, the way personal information is collected, stored and used will affect not only regulatory compliance but also public confidence in democratic processes. Mishandling voter data carries legal consequences under the Data Protection Act and can also undermine the credibility of institutions entrusted with safeguarding the electoral process.  

Ultimately, the ODPC’s guidance reflects a broader shift in Kenya’s regulatory landscape. The conversation is no longer only about conducting free and fair elections. It is increasingly about ensuring they are conducted in a manner that respects one of the Constitution’s fundamental rights, the “right to privacy.”