Inside data protection and access to information in corruption reporting

Kenya's accountability system is governed by two laws: the Access to Information Act (2016) and the Data Protection Act (2019). The Access to Information Act grants citizens the right to seek records held by both public and, in certain cases, private bodies. However, the Data Protection Act regulates how personal data in those records or corruption complaints is collected, used, shared, and protected.

When these laws intersect, such as when someone questions how public money was spent, seeks records on a government project, or names a person in a corruption report, both laws come into play.

Transparency International Kenya's 2025 Kenya Bribery Index reveals that one in four respondents across 15 counties experienced bribery situations, with most paying off. Only 17% reported the incident, an improvement from 13% in 2019 and 6% in 2017. The most common points of contact for bribery reports are the police, land offices, and civil registration.

People often remain silent due to low trust in enforcement agencies or fear of the accused. The Access to Information Act allows citizens to seek information on public spending, projects, contracts, and government decisions, while the Data Protection Act governs the processing of personal data, requiring lawful, fair, and transparent processing for a specified purpose and only to the extent necessary.

The challenge lies in balancing accountability and privacy, particularly as more corruption reporting moves online.