As digital transport platforms, financial institutions, employers and other data-driven services scale across Kenya and East Africa, individuals are increasingly subjected to automated decision-making, opaque data processing practices and privacy breaches contrary to Kenyan law. While the Data Protection Act establishes a strong framework for privacy protection, the extent to which data subjects can practically take control of their data depends on how accountability is operationalised within organisations and enforced by the regulator.

In practice, compliance is shaped not only by statutory obligations but also by internal organisational decision-making, operations and technical design choices. For data subjects, this often determines whether complaints are meaningfully addressed, explanations are provided and remedies are accessible.

This session brings together data protection officers from the private sector, a representative from the Office of the Data Protection Commissioner (ODPC) and a data governance policy expert to reflect on their lived experiences in enforcing the DPA and empowering data subjects to take control of their data. Drawing on recent enforcement actions and determinations, the discussion will interrogate how accountability is implemented in practice, the challenges encountered and how enforcement is evolving.