Data Governance and Policy

The Data Policy & Governance Centre (DPGC) produces independent, evidence-driven research to inform data policy and governance across the Global South. The DPGC responds to the increasing role of data in shaping governance, innovation, and social systems.

Data Policy & Governance Centre (DPGC)

The Data Policy & Governance Centre (DPGC) produces independent, evidence-driven research to inform data policy and governance across the Global South. The DPGC responds to the increasing role of data in shaping governance, innovation, and social systems. In a rapidly evolving digital environment where data-driven technologies influence economies and fundamental rights, the DPGC produces academically grounded research that promotes fair, transparent, and accountable data practices. The Centre’s work focuses on strengthening data protection, privacy, and the broader governance of data while maintaining academic independence and interdisciplinary engagement. By combining legal, policy, and technical expertise, the DPGC bridges research and practice to generate insights that inform regulatory development and support inclusive, rights-respecting innovation.

Focus areas

The DPGC’s activities are centred on advancing knowledge, practice, and policy around data governance. Specifically, the Centre focuses on:

  • Research and Analysis: Conducting research on emerging data governance issues, with a focus on producing practical insights that inform policy and regulation.

  • Policy Development and Advisory: Offering scholarly input that shapes the design and operationalisation of data protection and governance frameworks.

  • Capacity Building: Equipping policymakers, regulators, researchers, and practitioners with knowledge and skills through training, fellowships, and knowledge-sharing initiatives.

  • Public Engagement and Collaboration: Publishing research outputs, hosting dialogues, and facilitating partnerships between academia, civil society, and industry to advance evidence-based policymaking.

Contribution to the Field

The DPGC plays a vital role in shaping the understanding and practice of data governance in Africa. By offering impartial and academically rigorous research, the Centre provides valuable insights into how data can be governed responsibly to advance innovation while protecting fundamental rights. Its work contributes to the development of transparent and inclusive data ecosystems that serve both public and private interests.

As part of CIPIT, the DPGC aligns with the institution’s broader mission of producing research that informs African law, policy, and human rights. The Centre continues to act as a hub for dialogue, research, and collaboration on data governance, ensuring that emerging data practices are grounded in fairness, accountability, and respect for human dignity.

Automated Decision-Making Policies in Africa

The ‘Automated Decision Making (ADM) Policies in Africa’ project focused on various regulatory provisions governing automated decision-making in Ghana, Kenya and South Africa. It highlights the transformative potential of ADM systems across various sectors such as finance, healthcare, agriculture, education, and government in the continent. However, while ADM technologies have shown promise in improving efficiency, decision-making, and access to services, there are significant challenges to address, including data availability and quality, infrastructure limitations, biases in algorithms, and concerns regarding data privacy and security. The project therefore emphasises the importance of developing appropriate regulatory frameworks, promoting collaboration for data sharing, enhancing accountability for ADM developers and data processors, and investing in capacity building and upskilling to ensure responsible and inclusive adoption of ADM systems in Africa.

Dashboard

 

Report

AUTOMATED DECISION-MAKING POLICIES IN AFRICA

Summary The rapid advancement of technology has increased the use of Automated Decision-Making (ADM) systems in various sectors such as ...

Commercial Use of Personal Data (direct marketing) in Kenya.

The increased use of digital platforms in Kenya has changed the way marketing is conducted. Many companies and individuals have embraced direct marketing because it is affordable, enables one to attract new customers fast and one can reach target customers efficiently. The importance of direct marketing to a marketer is that it allows him to promote the product or service directly to his target audience. The availability of various marketing tools and the benefits that accrue with direct marketing has attracted many businesses thus causing many to incorporate the practice in their daily activities. The key outputs of this project were mainly a policy brief and an SME Manual.

The policy brief identifies existing Kenyan laws that are applicable to the practice of direct marketing while identifying any gaps in these legislations and making appropriate policy recommendations based on comparison with other jurisdictions. The approach used involved doctrinal research which was useful in analysing existing Kenyan laws to identify direct marketing provisions. A comparative analysis approach was also employed, and it was useful in formulating appropriate policy recommendations based on the gaps identified.

The findings from the policy brief indicate that:

    • Kenya already has four laws that are applicable to the practice of direct marketing.

    • Key definitions which are fundamental ingredients of direct marketing are not included in the legislations analysed.

    • The existence of big data has transformed how marketing is conducted.

    • External jurisdictions have tried to protect data subjects in the commercial use of personal data.

    • Numerous jurisdictions have updated their privacy laws and subsequently included direct marketing provisions to protect consumer data and measure up with global marketing privacy standards.

The SME Manual defines key terms essential for direct marketing, discusses what direct marketing entails and provides an in-depth analysis of relevant provisions of the Kenyan laws applicable to direct marketing that SMEs should be aware of. The Manual is meant to inform SMEs of the legal and regulatory landscape that govern the commercial use of personal data. It is also designed to enable SMEs grasp fundamental terminologies involved in direct marketing and the data protection requirements they are supposed to comply with when engaging in direct marketing practices. For compliance purposes, the manual contains a checklist formulated in accordance with the Data Protection Act 2019 and the Data Protection General Regulations 2021 that will enable marketers to comply with the law and avoid sending unsolicited communication to potential customers.

COMMERCIAL USE OF PERSONAL DATA (DIRECT MARKETING) IN KENYA – SMALL AND MEDIUM-SIZED ENTERPRISES (SME) MANUAL

Summary SMEs (small and mid-size enterprises) play a crucial role in job creation and contribution towards the Gross Domestic Product ...

Options for the Review of Commercial Use of Personal Data (Direct Marketing) Laws in Kenya

Options for the Review of Commercial Use of Personal Data (Direct Marketing) Laws in Kenya Summary The increased use of ...

Advancing the Governance of Data for Development in Africa – Strengthening Regional Integration and National Capacity in the Provision of Government Digital Services.

About the Project

This project, in collaboration with partners such as Research ICT Africa (RIA) and Local Development Research Institute (LDRI), will advance the governance and use of data for democratic, inclusive and equitable development in Africa. On the basis of a research agenda that provides an evidence base to harness the potential of digitalisation and datafication while mitigating the risks, it will contribute to progressive digital policy on the continent. This will entail supporting the development of an enabling environment with capable institutions for equitable and inclusive participation of all African people in the digital public sphere and as beneficiaries of public and private data value creation on the continent – particularly the large number of those at the intersections of multiple inequalities, such as women, the unemployed, migrants and refugees.

CIPIT’s core objectives include conducting surveys with institutional partners to understand challenges in governing digital and biometric ID data, particularly in implementing existing frameworks. The project also focuses on developing capacity-building tools and curricula for both State and non-State actors, including data protection authorities, and delivering regional capacity development courses.

Reports

A Report on the Study of Government Digital Services and Digital ID in Kenya and Zambia Summary

Report summary  ...

A Report on the Study of Government Digital Services and Digital ID in Kenya and Zambia

Report summary The report assesses digital ID and government digital services in Kenya and Zambia, noting significant strides in digitisation ...

Articles

Gendered Impacts of Government Digital Services in Kenya and Zambia

Introduction To enhance efficiency and broaden access to essential government services, Kenya and Zambia have digitised government services such as ...

The Role of the State and Foreign Companies in the Launch and Implementation of Digital Government Services in Kenya and Zambia

Introduction The emergence of the internet and transformative technology is altering processing, data storage capacity and the Information and Communication ...

Existing Inequalities Perpetuated by Government Digital Services in Kenya

Introduction Kenya has recognised the delivery of government digital services as a critical mechanism for fostering interaction between the government ...
Research Outputs

Gendered Impacts of Government Digital Services in Kenya and Zambia

Introduction To enhance efficiency and broaden access to essential government services, Kenya and Zambia have digitised government services such as ...

The Role of the State and Foreign Companies in the Launch and Implementation of Digital Government Services in Kenya and Zambia

Introduction The emergence of the internet and transformative technology is altering processing, data storage capacity and the Information and Communication ...

Existing Inequalities Perpetuated by Government Digital Services in Kenya

Introduction Kenya has recognised the delivery of government digital services as a critical mechanism for fostering interaction between the government ...

Understanding Botswana’s 2018 and 2024 Data Protection Acts

Introduction Botswana enacted its new Data Protection Act on 29 October 2024, repealing the 2018 Data Protection Act. The repealed ...

Facilitating Privacy Compliance in Nigeria: Key Issues in the GAID Draft 2024

INTRODUCTION Following the introduction of the widely lauded Nigeria Data Protection Act (NDP Act) in June 2023, Nigeria has made ...

Technology-Facilitated Rights and Digital Authoritarianism: Examining the Recent Internet Shutdown in Kenya

Introduction In the digital age, access to the internet has become a fundamental aspect of daily life, significantly influencing how ...

A Report on the Study of Government Digital Services and Digital ID in Kenya and Zambia

Report summary The report assesses digital ID and government digital services in Kenya and Zambia, noting significant strides in digitisation ...

Technology for Socio-Economic Development in Africa:Considering the Nuances of Leveraging Digital Public Goods in Africa.

Report Summary This report focuses on Digital Public Goods (DPGs) and how they can serve as a tool towards socio-economic ...

CROSS-BORDER DATA FLOWS IN AFRICA: EXPLORING LEGAL FRAMEWORKS AND REGIONAL IMPORTANCE

Report Summary This report examines the complex legal landscape governing cross-border data transfers in Africa. It highlights how data is ...

The Applications, Challenges and Regulation of Automated Decision-Making (ADM) in Africa

Report Summary This report critically examines how Automated Decision-Making (ADM) technologies are reshaping various sectors across the African continent. As ...

Data Deserts in Kenya: The Search for an Oasis

The report titled Data Deserts in Kenya: The Search for an Oasis addresses the digital divide in Kenya, which disproportionately impacts vulnerable ...

Understanding the Law in Upholding Image Rights: Perspectives from Around the World and Kenya

Summary How well do you understand your image rights and the best way to protect your image rights? Read our ...

Understanding Cybersecurity and Data Protection in Mauritius, Kenya, and Zimbabwe

Summary Data governance relies heavily on security. However, due to a lack of precise definitions in legislation, there is frequent ...

The Digital Era and Data: Considerations for National Statistical Office (NSOs) in the Digital Data Ecosystem

This report focuses on the digital transformation in National Statistical Offices (NSOs) in the digital era, focusing on changes in ...

Contextualising Political Advertising Policy to Political Micro-Targeting in Kenyan Elections

Summary The changing nature of election campaigns in Kenya over the years fuelled an investigation as to how data driven ...

Data Governance Principles Research & Development Project

Summary Digitalisation has resulted in increased data collection which forms an integral role in various industries and day-to-day activities thus ...

Empowering Online Voices: A CYRILLA Policy Brief on Freedom of Expression in Sub-Saharan Africa

Summary The CYRILLA policy brief titled "Empowering Online Voices: Freedom of Expression in Sub-Saharan Africa" provides a comprehensive evaluation of ...

AUTOMATED DECISION-MAKING POLICIES IN AFRICA

Summary The rapid advancement of technology has increased the use of Automated Decision-Making (ADM) systems in various sectors such as ...

Options for the Review of Commercial Use of Personal Data (Direct Marketing) Laws in Kenya

Options for the Review of Commercial Use of Personal Data (Direct Marketing) Laws in Kenya Summary The increased use of ...

DEVELOPING DATA PROTECTION GUIDELINES FOR THE HEALTH SECTOR IN KENYA

Summary Kenya adopted the Data Protection Act (DPA) in 2019, fortifying individuals’ right to privacy and strengthening protection of their ...

Why Data Protection Matters for Development: The Case for Strengthening Inclusion and Regulatory Capacity

A policy note from Centre For Global Development that draws on insights gained from the Governing Data for Development project ...

Image Rights – Release Form Information Pack

Summary This comprehensive info pack offers an essential guide to understanding and using image rights release forms effectively. Learn about ...

COMMERCIAL USE OF PERSONAL DATA (DIRECT MARKETING) IN KENYA – SMALL AND MEDIUM-SIZED ENTERPRISES (SME) MANUAL

Summary SMEs (small and mid-size enterprises) play a crucial role in job creation and contribution towards the Gross Domestic Product ...

Stay Updated

Subscribe to our newsletter to receive the latest research, publications, and blog posts directly in your inbox.