Kenya: Office of the Data Protection Commissioner adopted guidance on processing of personal data for research purposes

On 6 November 2025, the Office of the Data Protection Commissioner (ODPC) adopted a guidance note on the processing of personal data for research purposes. The guidance issued pursuant to Section 53(3) of the Data Protection Act, 2019, and the Data Protection Regulations, 2021, establishes a framework for lawful and ethical processing of personal data for research activities across public and private sectors. It defines the legislative framework for such activities, including the Constitution of Kenya 2010, the Science, Technology and Innovation Act, and the National Guidelines for Ethical Conduct of Biomedical Research, outlining compliance obligations, principles of lawfulness, fairness, transparency, storage limitation, accountability, and conditions for exemptions under public interest. The guidance notes also set out methods for secure data handling while conducting research, including anonymisation and pseudonymisation, as well as the principle of non-identifiable data for research publications.