Data protection office bets on global quality standards amid rising cyber threats

Kenya loses at least Sh29 billion annually to cybersecurity threats, according to estimates by the Communications Authority of Kenya.

As cyber threats continue to expose businesses, government institutions and individuals to growing digital risks, regulators are increasingly under pressure to demonstrate efficient, transparent and accountable systems capable of protecting personal data.

The latest high-profile cyber-attack targeted President William Ruto’s official website. On Saturday, July 18, 2026, unknown hackers successfully breached the presidential platform. The government confirmed that no sensitive state data was exfiltrated or lost. The website was safely restored and fully operational by Monday, July 20, 2026.

Against this backdrop, the Office of the Data Protection Commissioner (ODPC) has adopted the ISO 9001:2015 Quality Management System (QMS), an internationally recognised framework aimed at improving service delivery, strengthening accountability and standardising organisational processes.

The Office officially launched the system on July 14, 2026, beginning what it describes as a phased journey towards full ISO 9001:2015 certification. The initiative comes as Kenya's digital economy continues to expand, increasing the volume of personal data processed across government, financial services, healthcare, education, e-commerce and other sectors.

Widely adopted by public and private institutions worldwide, ISO 9001:2015 provides a framework for managing organisational processes through documented procedures, performance monitoring, risk-based planning and continuous improvement.

For a regulator charged with safeguarding personal data, adoption of the QMS reflects the regulator's effort to strengthen its internal operations as demand for data protection oversight continues to grow.

Data Commissioner Immaculate Kassait said the launch marks the beginning of a broader institutional process rather than the completion of certification.

"We have begun a journey towards ISO certification. Before you can get ISO certification, you have to train your staff, create processes and ensure every procedure can be measured and verified," Kassait said.

She said the Office will spend the coming months implementing the QMS before undergoing an independent external audit required for certification.

"What this means for our clients and stakeholders is that we are going to improve and enhance our services for purposes of quality and also allow consistency. We will continuously improve what we do and what we commit to do to our clients," she said.

Development of the QMS was supported by the World Bank through the Kenya Digital Economy Acceleration Project (KDEAP), implemented by the ICT Authority.

Established under the Data Protection Act, 2019, the ODPC is Kenya's independent regulator responsible for overseeing compliance with the country's data protection law. Its mandate includes registering data controllers and processors, investigating complaints, enforcing compliance, issuing regulatory guidance and promoting awareness of data protection rights and obligations.

The regulator's responsibilities have expanded alongside rapid digital transformation. Increased adoption of cloud computing, digital financial services, artificial intelligence, biometric technologies and cross-border digital services has created new opportunities for innovation while introducing increasingly complex challenges relating to privacy, accountability and the lawful processing of personal data.

As organisations collect and process larger volumes of personal information, effective regulatory oversight depends not only on a robust legal framework but also on institutional capacity. Quality management systems support that objective by establishing clear operational procedures, improving record management, promoting evidence-based decision-making and encouraging continuous improvement.

Standardised internal processes can also strengthen institutional memory, improve consistency in regulatory decision-making and reduce administrative delays in handling complaints and requests for guidance. For regulators, such systems also enhance public confidence by ensuring services are delivered predictably and transparently.

The ODPC says implementation of the QMS is expected to strengthen leadership accountability, improve operational efficiency, enhance stakeholder satisfaction and foster a culture of continuous improvement while aligning its operations with internationally recognised management standards.

Ultimately, the effectiveness of the reforms will be measured by tangible outcomes, including the timely resolution of complaints, consistency in regulatory decisions, accessibility of guidance provided to organisations and members of the public and the effectiveness of enforcement where personal data is unlawfully processed or misused.

The initiative comes as governments across Africa continue reviewing legal and institutional frameworks to address emerging issues including cybersecurity, online safety, AI, children's digital rights and the growing movement of personal data across borders. Strengthening regulatory institutions is increasingly viewed as an important complement to legislative reforms aimed at safeguarding privacy and building trust in digital services.

As Kenya's digital economy continues to evolve, the effectiveness of its data protection regime will depend not only on the strength of its legal framework but also on the capacity, consistency and accountability of the institutions responsible for enforcing it. The adoption of internationally recognised quality management standards marks an important step towards strengthening that institutional capacity.