Kenya: Office of the Data Protection Commissioner closed consultation on draft guidance note on the processing of children’s data

On 30 May 2025, the Office of the Data Protection Commissioner (ODPC) closed the public consultation, which had been open since 16 May 2025, on the Draft Guidance Note on the Processing of Children’s Data. The draft guidance, prepared in accordance with the Data Protection Act, 2019, and the Data Protection (General) Regulations, 2021, establishes a framework for lawful and fair processing of personal data of persons under eighteen years. It specifies the obligations of data controllers and processors across both public and private sectors, covering lawful basis and parental consent, validation of parental authority, and procedures for age verification. The draft further details safeguards for sensitive data, reinforces principles of data minimisation, accountability, and privacy by design and by default, and mandates data protection impact assessments for high-risk processing. It also addresses online protection, data retention, transparency, and breach notification to uphold the best interests of the child.