Data Governance and Policy

Data Policy & Governance Centre (DPGC)

The Data Policy & Governance Centre (DPGC) produces independent, evidence-driven research to inform data policy and governance across the Global South. The DPGC responds to the increasing role of data in shaping governance, innovation, and social systems. In a rapidly evolving digital environment where data-driven technologies influence economies and fundamental rights, the DPGC produces academically grounded research that promotes fair, transparent, and accountable data practices. The Centre’s work focuses on strengthening data protection, privacy, and the broader governance of data while maintaining academic independence and interdisciplinary engagement. By combining legal, policy, and technical expertise, the DPGC bridges research and practice to generate insights that inform regulatory development and support inclusive, rights-respecting innovation.

Focus areas

The DPGC’s activities are centred on advancing knowledge, practice, and policy around data governance. Specifically, the Centre focuses on:

• Research and Analysis: Conducting research on emerging data governance issues, with a focus on producing practical insights that inform policy and regulation.

• Policy Development and Advisory: Offering scholarly input that shapes the design and operationalisation of data protection and governance frameworks.

• Capacity Building: Equipping policymakers, regulators, researchers, and practitioners with knowledge and skills through training, fellowships, and knowledge-sharing initiatives.

• Public Engagement and Collaboration: Publishing research outputs, hosting dialogues, and facilitating partnerships between academia, civil society, and industry to advance evidence-based policymaking.

Contribution to the Field

The DPGC plays a vital role in shaping the understanding and practice of data governance in Africa. By offering impartial and academically rigorous research, the Centre provides valuable insights into how data can be governed responsibly to advance innovation while protecting fundamental rights. Its work contributes to the development of transparent and inclusive data ecosystems that serve both public and private interests.

As part of CIPIT, the DPGC aligns with the institution’s broader mission of producing research that informs African law, policy, and human rights. The Centre continues to act as a hub for dialogue, research, and collaboration on data governance, ensuring that emerging data practices are grounded in fairness, accountability, and respect for human dignity.

Automated Decision-Making Policies in Africa

The ‘Automated Decision Making (ADM) Policies in Africa’ project focused on various regulatory provisions governing automated decision-making in Ghana, Kenya and South Africa. It highlights the transformative potential of ADM systems across various sectors such as finance, healthcare, agriculture, education, and government in the continent. However, while ADM technologies have shown promise in improving efficiency, decision-making, and access to services, there are significant challenges to address, including data availability and quality, infrastructure limitations, biases in algorithms, and concerns regarding data privacy and security. The project therefore emphasises the importance of developing appropriate regulatory frameworks, promoting collaboration for data sharing, enhancing accountability for ADM developers and data processors, and investing in capacity building and upskilling to ensure responsible and inclusive adoption of ADM systems in Africa.

Dashboard

Report

Policy Briefs

AUTOMATED DECISION-MAKING POLICIES IN AFRICA

Summary The rapid advancement of technology has increased the use of Automated Decision-Making (ADM) systems in various sectors such as ...

Read More

Commercial Use of Personal Data (direct marketing) in Kenya.

The increased use of digital platforms in Kenya has changed the way marketing is conducted. Many companies and individuals have embraced direct marketing because it is affordable, enables one to attract new customers fast and one can reach target customers efficiently. The importance of direct marketing to a marketer is that it allows him to promote the product or service directly to his target audience. The availability of various marketing tools and the benefits that accrue with direct marketing has attracted many businesses thus causing many to incorporate the practice in their daily activities. The key outputs of this project were mainly a policy brief and an SME Manual.

The policy brief identifies existing Kenyan laws that are applicable to the practice of direct marketing while identifying any gaps in these legislations and making appropriate policy recommendations based on comparison with other jurisdictions. The approach used involved doctrinal research which was useful in analysing existing Kenyan laws to identify direct marketing provisions. A comparative analysis approach was also employed, and it was useful in formulating appropriate policy recommendations based on the gaps identified.

The findings from the policy brief indicate that:

• • Kenya already has four laws that are applicable to the practice of direct marketing.

  • Key definitions which are fundamental ingredients of direct marketing are not included in the legislations analysed.

  • The existence of big data has transformed how marketing is conducted.

  • External jurisdictions have tried to protect data subjects in the commercial use of personal data.

  • Numerous jurisdictions have updated their privacy laws and subsequently included direct marketing provisions to protect consumer data and measure up with global marketing privacy standards.

The SME Manual defines key terms essential for direct marketing, discusses what direct marketing entails and provides an in-depth analysis of relevant provisions of the Kenyan laws applicable to direct marketing that SMEs should be aware of. The Manual is meant to inform SMEs of the legal and regulatory landscape that govern the commercial use of personal data. It is also designed to enable SMEs grasp fundamental terminologies involved in direct marketing and the data protection requirements they are supposed to comply with when engaging in direct marketing practices. For compliance purposes, the manual contains a checklist formulated in accordance with the Data Protection Act 2019 and the Data Protection General Regulations 2021 that will enable marketers to comply with the law and avoid sending unsolicited communication to potential customers.

Manuals

COMMERCIAL USE OF PERSONAL DATA (DIRECT MARKETING) IN KENYA – SMALL AND MEDIUM-SIZED ENTERPRISES (SME) MANUAL

Summary SMEs (small and mid-size enterprises) play a crucial role in job creation and contribution towards the Gross Domestic Product ...

Read More

Policy Briefs

Options for the Review of Commercial Use of Personal Data (Direct Marketing) Laws in Kenya

Options for the Review of Commercial Use of Personal Data (Direct Marketing) Laws in Kenya Summary The increased use of ...

Read More

Advancing the Governance of Data for Development in Africa – Strengthening Regional Integration and National Capacity in the Provision of Government Digital Services.

About the Project

This project, in collaboration with partners such as Research ICT Africa (RIA) and Local Development Research Institute (LDRI), will advance the governance and use of data for democratic, inclusive and equitable development in Africa. On the basis of a research agenda that provides an evidence base to harness the potential of digitalisation and datafication while mitigating the risks, it will contribute to progressive digital policy on the continent. This will entail supporting the development of an enabling environment with capable institutions for equitable and inclusive participation of all African people in the digital public sphere and as beneficiaries of public and private data value creation on the continent – particularly the large number of those at the intersections of multiple inequalities, such as women, the unemployed, migrants and refugees.

CIPIT’s core objectives include conducting surveys with institutional partners to understand challenges in governing digital and biometric ID data, particularly in implementing existing frameworks. The project also focuses on developing capacity-building tools and curricula for both State and non-State actors, including data protection authorities, and delivering regional capacity development courses.

Reports

Report Summary

A Report on the Study of Government Digital Services and Digital ID in Kenya and Zambia Summary

Report summary  ...

Read More

Reports

A Report on the Study of Government Digital Services and Digital ID in Kenya and Zambia

Report summary The report assesses digital ID and government digital services in Kenya and Zambia, noting significant strides in digitisation ...

Read More

Articles

Access To InformationBlogData GovernanceDG Articles

Gendered Impacts of Government Digital Services in Kenya and Zambia

Introduction To enhance efficiency and broaden access to essential government services, Kenya and Zambia have digitised government services such as ...

Read More

Access To InformationBlogData GovernanceDG Articles

The Role of the State and Foreign Companies in the Launch and Implementation of Digital Government Services in Kenya and Zambia

Introduction The emergence of the internet and transformative technology is altering processing, data storage capacity and the Information and Communication ...

Read More

Access To InformationBlogData GovernanceDG Articles

Existing Inequalities Perpetuated by Government Digital Services in Kenya

Introduction Kenya has recognised the delivery of government digital services as a critical mechanism for fostering interaction between the government ...

Read More