Kenya’s privacy framework is reaching a crucial milestone as the country aligns its domestic legal regime with international gold standards such as the European Union’s General Data Protection Regulation (GDPR). Section 2 of Kenya’s Data Protection Act (DPA), supported by regulatory guidelines from the Office of the Data Protection Commissioner (ODPC), has expanded the statutory definition of sensitive personal data.   

By formally elevating political opinions and trade union membership to this protected classification, the framework introduces rigorous new compliance standards for political entities, employers, tech platforms, and data controllers across the nation. 
   

The Spotlight: The 2 Expanded Sensitive Data Classes  

While all sensitive data classes require strict safeguards, these two expanded categories fundamentally affect civic engagement, workplace relations, and digital campaigns in Kenya.   

1. Political Opinions

• Scope: Any information revealing an individual’s political affiliations, party memberships, campaign donations, voting choices, or political ideological stances.
• The Risk: In modern digital campaigns and voter registration drives, political profiling can be weaponised for micro-targeted voter manipulation, psychological profiling, and targeted voter suppression. In wider society, unmonitored exposure creates distinct risks of political discrimination or civil intimidation.

•  Operational Rules: Political parties, campaign organisations, polling firms, media agencies, and ad-tech networks can no longer scrape, infer, or track political views using soft consent, pre-checked boxes, or dark patterns. Express, written opt-in consent is mandatory before processing.   

2. Trade Union Memberships

• • Scope: Records indicating whether an employee is affiliated with, active in, or paying membership dues to a trade union or labour association. 

• • The Risk: Labour relations entail an inherent power dynamic between employers and workers. Inadequate protection of union membership data exposes workers to employer retaliation, unfair promotion decisions, blacklisting, or interference in collective bargaining. 

• • Operational Rules: Human resources departments, payroll processors, and HR management software platforms must segregate union deduction registers and enforce strict, role-based access controls. Disclosing union rosters across corporate hierarchies without explicit statutory grounds or direct worker authorisation constitutes an actionable breach.  

Comprehensive Overview: All Baseline Sensitive Data Classes  

These two new categories join the established baseline of sensitive personal data categories under Kenya’s regulatory framework:   

Key Operational Rules for Data Handlers  

To legally collect or process any sensitive personal data, especially political and union data, organisations operating in Kenya must adhere to three core requirements: