NAIROBI, Kenya Feb 3 – Data Commissioner Immaculate Kassait has warned that every time you swipe your ID at a mall, register at a gated estate, or pass a CCTV camera, you’re leaving behind a trail of personal information.
While the measures are meant to keep you safe, Kassait said most Kenyans don’t realize how much of their data is collected, stored, and monitored — or who is responsible for it.
Speaking on Capital FM’s Capital In The Morning on Tuesday, Kassait explained that private security firms are legally required to collect certain personal data to protect the public but trust and accountability are just as important as security.
“If you want to know how valuable data is, look at how it drives not just safety, but the entire digital economy,” she said.
Kassait noted that the Private Security Act allows security companies to collect information like your name, ID number, phone number, and sometimes even your vehicle details.
The reason? To respond effectively to emergencies, including terrorist attacks, thefts, or other security threats.
“The law was passed to help in case of danger or emergencies. But the key question is how long is this information stored, and how is it protected?” Kassait asked.
– The risks of giving out personal information –
Even though collecting your data is legal, Kassait warned that trust is critical.
Many people give out their information without thinking whether at a supermarket, a gated community, or a public event yet security firms must store it responsibly, explain how they use it, and ensure it is safe from misuse.
She gave examples of recent violations: cybercafés sharing uploaded CVs without consent and beauty salons posting clients’ photos online.
“Such breaches erode trust and can lead to fines. Without trust, even lawful data collection can backfire. Customers and residents stop cooperating, which makes security harder,” she said.
Kassait urged Kenyans to know why their data is collected, ask who can access it and for how long, request corrections if it’s wrong, and exercise their right to be forgotten when applicable.
“Online hygiene starts with you, just like locking your doors at home. Security begins with awareness.”
Kenya’s Office of the Data Protection Commissioner (ODPC) is enforcing compliance through registration, guidance, and oversight of data handlers.
Kassait explained that institutions failing to comply — including private security companies — face enforcement notices and fines.
The ODPC is also pushing for better public awareness, especially among the youth, and working on international agreements to make sure data flows safely across borders.
“We want Kenyans to share data safely, not blindly. Security is important, but accountability and trust are what make it effective,” she said.