Month: June 2026

The Data Protection Act, (Cap. 411C), Laws of Kenya (the Data Protection Act), under Section 41, requires data controllers and processors (data handlers) to implement appropriate organisational and technical safeguards to protect the right to privacy. This obligation is known as data protection by design and by default. “By design” connotes that data protection principles should be considered from the outset when developing any data processing activity, while “by default” means the highest privacy standards apply automatically to all such activities.

Data protection by design and by default may involve conducting a Data Protection Impact Assessment (DPIA) to identify and mitigate risks associated with a processing activity. It may also entail assessing whether appropriate measures exist before transferring personal data to another jurisdiction, or whether consent obtained from data subjects meets the threshold under the Data Protection Act. Overall, data protection by design and by default ensures that data handlers achieve their objectives in the least privacy-intrusive way possible.

Enter the now infamous Worldcoin Project fiasco, which propelled concerns about data protection in Kenya into a frenzy. The Applicants in Republic v. Tools for Humanity Corporation (US) & 8 others; Katiba Institute & 4 others (Ex parte Applicants); Data Privacy & Governance Society of Kenya (Interested Party) [2025] eKLR applied for judicial review Orders to prohibit the data handlers therein from processing biometric personal data collected from Kenyan citizens without conducting a DPIA or from obtaining consent through financial inducement.

In its Judgment, the High Court considered the place of DPIAs in the data processing activities and the effect of offering financial incentives to obtain consent from data subjects.

In seeking to persuade the Court, the Applicants argued, first, that the 1^st – 5^th Respondents had processed biometric personal data without conducting an adequate DPIA. Second, they contended that although the said Respondents had obtained consent from data subjects, such consent was induced through financial incentives in the form of cryptocurrency tokens. Finally, they argued that the cross-border data transfers by 1^st – 5^th Respondents were contrary to the procedures prescribed under the Data Protection Act and its subsidiary legislation.

 

Implications of the Judgment to Data Handlers

1. When should a data handler conduct a DPIA?

   The Court was tasked with determining whether the 1st – 5th Respondents were required to conduct a DPIA under Section 31 of the Data Protection Act, following their decision to process the biometric details of data subjects, that is, their iris and facial scans, which constitute sensitive personal data requiring a higher degree of protection due to their very nature. The Court found that the 1st – 5th Respondents had not carried out a DPIA prior to processing the biometric personal data, in contravention of the Data Protection Act. Consequently, the Court, inter alia, prohibited any further processing of biometric personal data collected in Kenya for the Worldcoin Project without first undertaking a DPIA.It is noteworthy that the Office of the Data Protection Commissioner (ODPC), in its Guidance Note on DPIAs (the DPIA Guidance Note), describes a DPIA as an accountability tool that enables data handlers to identify, assess, and mitigate risks to the rights and freedoms of data subjects during data processing activities. This begs the question, what constitutes an adequate DPIA, and when should a data handler carry out one?

   Section 31 of the Data Protection Act and regulation 49 of the Data Protection (General) Regulations provide a checklist that data handlers should consider when assessing whether to carry out a DPIA. For any data processing exercise that is likely to pose a high risk to the rights and freedoms of data subjects, a data handler is required to conduct a DPIA and submit a DPIA report sixty (60) days before processing personal data.

   Additionally, regulation 49 of the Data Protection (General) Regulations exhaustively enumerates high-risk instances in which a data handler is required to conduct a DPIA. Some of these high-risk instances include where – a) personal data collected on a large-scale is used for a purpose different from the original purpose; b) biometric or genetic data is processed; and c) there is large scale processing of personal data.

   DPIAs, therefore, enable data handlers to assess whether a data processing activity poses high-level risks to data subjects and to determine the safeguards necessary to mitigate such risks.

   In delving deeper into what constitutes an adequate DPIA, we refer to the DPIA Guidance Note for further direction. The DPIA Guidance Note provides that, for a DPIA to meet the minimum requirements of the Data Protection Act and its subsidiary legislation, it must address the amount of personal data processed; the extent of processing; the storage and accessibility of the personal data; the state of technological development available for processing; the specific risks attendant to the processing of personal data; a systematic description of the intended processing operations; the purpose of processing; the necessity and proportionality of the processing operations; the risks to the rights and freedoms of data subjects; the measures envisaged to address the identified risks; and the safe guards implemented to ensure the protection of personal data.

2. Can a data handler incentivise a data subject to give their consent?

   The Court determined that offering cryptocurrency tokens in exchange for biometric personal data cast an aspersion on whether the consent obtained from the data subjects was valid. The Court observed that, “The use of cryptocurrency tokens to gather personal data is, in my humble view, an attempt to bypass the spirit of data protection laws by using incentives to sidestep the true essence of informed consent by luring desperate and poor Kenyans with cryptocurrency to kens.”

   Regarded as the cornerstone of data protection, consent must be express, unequivocal, freely given, specific, and an informed indication of the data subject’s wishes. It should be expressed through a statement or a clear affirmative action, signifying agreement to the processing of personal data relating to that data subject.

   In examining the Worldcoin Project case, we are of the considered view that the consent sought by the 1st – 5th Respondents was invalid, not only for the reason cited by the Court, that is, that the data subjects were not informed of the data processing activity, but also because the data subjects were not given a free choice to agree to the processing. In its Guidance Note on Consent, the ODPC stipulates that, for a data handler to satisfy the element of “free” choice, a data subject must have real choice and control over their personal data, with the liberty to withdraw consent at any time. The Guidance Note on Consent provides that a data subject must not feel compelled to give consent or fear negative consequences should they exercise their right of withdrawal. In the Worldcoin Project case, it is arguable that, since the data subjects were offered a financial incentive of approximately KES 7,000 (USD 50) in cryptocurrency for their personal data, they may have felt constrained from withdrawing their consent for fear of being asked to refund the cryptocurrency.

3. What must a data handler comply with prior to transferring personal data to another jurisdiction?

   This decision reinforces the need for data handlers to ensure that cross-border transfers of personal data comply with the provisions of the Data Protection Act and its subsidiary legislation. The Court determined that the 1st – 5th Respondents transferred personal data outside Kenya without adhering to the requirements under Section 48 of the Data Protection Act and Part VII of the Data Protection (General) Regulations, which outline the conditions under which personal data may be transferred outside Kenya.

   Before effecting a cross-border transfer of personal data, the trans fer must be based on

• Appropriate safeguards, i.e., a binding legal instrument with the recipient or upon an assessment of the transfer exercise.
• Adequate decision from the ODPC, which has been afforded wide latitude to determine whether the recipient country has adequate data protection measures.
• Necessity – that the cross-border transfer is necessary to achieve the purposes outlined under Section 48 of the Data Protection Act, including the performance of a contract between the data subject and the data handler.
• Consent – in the absence of appropriate safeguards adopted by the recipient, an adequacy decision, or necessity, the Data Protection (General) Regulations prescribe that a data subject may give their consent to the transfer upon being duly informed of the risks associated with such a transfer to their personal data

 

Conclusion

This Judgment rings true to the growing need to create a privacy-centric culture, one where data protection is by design and by default. While the Judgment underscored key areas of data protection compliance, particularly the importance of carrying out a DPIA where necessary, what amounts to valid consent, and the lawful bases for cross-border transfers, it ultimately serves as a clarion call to entities engaged in data processing activities to build with privacy compliance, not breach, in mind.

Kenya has made significant progress in protecting and promoting the rights of Persons with Disabilities (PWDs) by enacting the Persons with Disabilities Act No. 4 of 2025 (the New Act), which replaces the Persons with Disabilities Act, 2003 (the Repealed Act). Although the Repealed Act was viewed as a milestone at the time, the Act failed to ensure complete inclusion for PWDs, effective enforcement and conformity with the Constitution of Kenya, 2010 (the Constitution), as well as relevant International Human Rights standards like the United Nations Convention on the Rights of Persons with Disabilities (UNCRPD).

Therefore, the New Act represents a shift from a welfare-driven, charity-focused model to a rights-based approach that empowers PWDs and emphasises dignity, equality, and participation.

Background and Justification for the New Act

The Repealed Act was Kenya’s initial attempt at establishing a legal framework for PWDs’ rights. The Repealed Act was based, however, on the medical and charity models of disability, in which disability was addressed as an individual’s tragedy or a medical issue that needed to be cured, and PWDs as passive recipients of state assistance.

Such matters as effective legal remedies and enforcement were lacking under the Repealed Act. Discrimination in areas like education, employment, and public services went unpunished, allowing institutions to disregard inclusion without consequences. For instance, employers were merely encouraged, not obligated, to hire PWDs. Public facilities remained inaccessible, and segregated schools were favoured over inclusive education systems, which perpetuated marginalisation.

Symbolic compliance in relation to matters touching on PWDs was common: laws existed, yet they were not enforced or put into action. Public buildings sometimes erected ramps or signals but did not go further to make fundamental alterations, like offering tactile routes, lifts, or accessible lavatories. Civic participation was also limited, as many PWDs could not vote independently due to a lack of accessible voting materials. These shortcomings, together with the civil society and PWDs’ lobbying efforts, gave the impetus for a new, enforceable, and participatory piece of law.

Key Reforms in the New Act

Introduced in 2023 and enacted in May 2025, the New Act aligns with Kenya’s constitutional values and international commitments.

At its core, the New Act promotes a rights-based approach to disability. It guarantees legal capacity, prohibits discrimination and demands reasonable accommodation across areas such as education, employment, healthcare, public services and civic participation. Additionally, the New Act establishes penalties and accountability measures for enforcement.

In education, the law mandates inclusive learning instead of segregated special schools. Children with disabilities must be admitted to mainstream schools with suitable support systems, like individual learning plans, trained teachers and assistive devices. This inclusion helps children grow up in a diverse environment and prepares them for full participation in society in the future.

Employers are legally required to provide reasonable accommodation and take proactive steps to ensure equal opportunities for PWDs. Additionally, vocational training and financial grants are available to support economic empowerment.

The Act requires all public buildings, transport systems, and digital platforms to comply with accessibility standards. Institutions that do not comply face penalties, while the National Council for Persons with Disabilities is authorised to conduct audits and issue sanctions.

In a notable enhancement, Section 22 of the New Act specifically prohibits an employee’s dismissal or demotion for having or acquiring a disability. Employers must thus implement suitable accommodation for employees who acquire disability during their tenure, which may include considering redeployment to an alternative role that suits their needs. This provision should be read alongside the provisions of Sections 41 and 45 of the Employment Act, (Cap. 226) of the Laws of Kenya (the Employment Act), which set out the requirements for procedural and substantive fairness in all employment terminations.

While the Employment Act allows termination on medical grounds if due process is followed and the employee is proven medically un f it, the New Act introduces an additional requirement: that employers must consider reasonable accommodation and possible redeployment when determining substantive fairness. It places a greater burden on employers to demonstrate that all possible accommodations were considered and exhausted before termination can be justified on grounds of disability. This marks a significant shift from the previous Act, as employers must now proactively work to retain an employee with disabilities rather than simply proving their medical incapacity. In aligning with these new requirements, employers can foster a more inclusive and supportive workplace for all.

Further, the New Act focuses on the Medical, Social and Human Rights models. The Medical Model within the New Act manifests itself in the provisions relating to health and rehabilitation. The New Act recognises that some individuals with disabilities need specialised medical care and support. Therefore, the New Act mandates access to healthcare services, assistive devices and rehabilitation programs, acknowledging that these are crucial for enhancing a person’s functional capacity. While not the only focus, this aspect of the New Act ensures the physical and mental well-being of PWDs remains a central consideration, providing a foundation for their independence and quality of life.

On the other hand, the Social Model in the New Act moves focus from an individual’s impairment to the societal barriers that contribute to disability. The Act imposes concrete legal obligations to eliminate these barriers. For instance, Section 30 of the New Act requires all public infrastructure, including buildings and transportation, to be accessible to all persons, including PWDs. It also requires inclusive education systems that provide reasonable accommodation for PWDs.

Finally, the Human Rights Model in the New Act views PWDs as rights-holders with inherent human dignity, equality and autonomy, as opposed to objects of charity or medical treatment. The New Act provides legal remedies and penalties for violations of PWDs’ rights. The New Act also safeguards PWDs’ rights to independent living and legal capacity.

The New Act, anchoring on the three (3) models already discussed, defines a broad range of rights that impact various aspects of life for PWDs. Some of these rights include the Right to Equality and Non-Discrimination; Right to Inclusive Education; Right to Health; Right to Work and Employment; Right to Family Life and Privacy; Protection from Abuse and Exploitation (abuse is criminalized and institutions must implement safeguarding policies); Right to Accessibility and Right to Participate in Public and Political Life (PWDs have the right to vote, run for office and take part in public decision-making).

 

Special Rights for Children with Disabilities

The New Act includes vital protections and services for children with disabilities summarised as follows:

• Early Identification and Intervention: Requires early screening and diagnosis to ensure timely support.
• Family Support Services: Offers counselling, respite care and training for parents.
• Inclusive Play and Recreation: Public play areas and recreation facilities must accommodate children with disabilities.
• Protection from Institutionalisation: Children should grow up in family settings unless institutional care is absolutely necessary.
• Participation in Decision-making: Children with disabilities have the right to be heard on matters affecting their lives.

 

Potential Challenges to Parents, Caregivers and Society in General

A successful implementation of the New Act will require overcoming several key challenges, which include:

• Limited Awareness: Many parents and caregivers do not know about the rights and services available under the New Act, particularly in rural areas.
• Bureaucratic Hurdles: Accessing services may involve complex paperwork and unclear procedures, which can dissuade families from seeking help.
• Infrastructure Gaps: Schools, health facilities and transport systems may not yet be fully accessible or properly resourced.
• Cultural Stigma: Deep-rooted social attitudes may continue to marginalise PWDs and discourage families from seeking assistance.
• Weak Enforcement: Despite strong provisions, there are concerns about the capacity of enforcement bodies.
• Confusion during Transition: The shift from the Repealed Act to the New Act may create uncertainty for institutions and caregivers.

 

Recommendations for Overcoming Challenges

To assist parents, caregivers, and the wider society in addressing these challenges, we consider the following key steps essential for the effective and comprehensive implementation of the New Act:

• Awareness Campaigns: Use mass media and public forums to educate the general public on the New Act.
• Investment in Inclusive Infrastructure: The Government should allocate a budget for accessible schools, hospitals and transport.
• Combating stigma: Promote positive portrayals of PWDs in the media and incorporate disability rights in school curricula.
• Strengthen Enforcement: Empower the National Council for Persons with Disabilities to audit, monitor and penalise non-compliance.
• Guide the Transition: Provide training and clear instructions to caregivers, service providers, and institutions.

 

Conclusion

The New Act signifies a major step in Kenya’s dedication to the rights and dignity of PWDs. In shifting from a welfare model to a strong, enforceable, and rights-based framework, the New Act creates groundwork for a more inclusive society.

With respect to parents and caregivers of PWDs, the New Act brings with it new hope and tools for securing a better future for their children. The success of the New Act is, however, anchored on mutual responsibility, creating awareness, government action and ongoing advocacy by and on behalf of PWDs.

 

Climate finance lies at the intersection of two critical global challenges – climate change and sustainable development. While the urgency for climate action continues to grow, the financial systems meant to support this transition are evolving but remain far from adequate.

The Nationally Determined Contributions (NDCs) under the Paris Agreement, climate risk assessments, and national development plans have increasingly become a priority to States and entities. As such, they are now driving sustainable and green infrastructure finance to meet national climate objectives. That notwithstanding, this approach faces its fair share of challenges.

This gap highlights not only inadequate capital allocation to climate finance, but also the institutional and structural barriers, such as regulatory shortcomings, limited project readiness, insufficient data and the general perception of high risk by investors. For private investors and lenders, recognising these constraints is imperative to mitigating risks and exploring innovative financing structures that can unlock value in green projects.

For instance, blended finance, which combines public, philanthropic, or concessional capital with private investment, has shown promise in reducing risk and attracting commercial investors. Instruments such as green bonds, sustainability-linked loans, and carbon credit mechanisms are increasingly being deployed to mobilise capital toward climate-related initiatives.

 

Evolving Landscape of Green Finance

Green finance has advanced significantly in recent years, moving from a fringe interest to a core element of global financial markets.

Institutional investors are increasingly integrating environmental, social, and governance (ESG) factors into their investment decisions to meet the sustainability and regulatory quota.

Key instruments, including green bonds, which finance projects with clear environmental benefits; sustainability-linked loans, where interest rates are tied to achieving sustainability performance targets; blue finance, which targets marine conservation and sustainable use of ocean resources; and resilience bonds, designed to fund climate adaptation and disaster risk reduction, have introduced new facets to green finance.

Technological innovations such as blockchain and fintech platforms are also beginning to revolutionise the accessibility, traceability, and transparency of green finance, especially for small-scale or community-led projects.

Additionally, taxonomies and verification frameworks have increasingly become standard practice, with frameworks such as the EU Green Taxonomy, the International Capital Market Association (ICMA) principles, and, closer home, the Kenya Green Finance Taxonomy are growing investor confidence and mainstreaming green finance.

 

Policy Frameworks and the Role of Climate Finance

Various factors impact the success of a climate finance project. However, one of the key hallmarks of an effective climate finance structure rests on the foundation of clear and comprehensive legal, regulatory, and policy frameworks. Kenya has established fundamental regulatory frameworks and policies to support climate project finance. These include:

1. i) The Constitution of Kenya, 2010, which guarantees every citizen the right to a clean and healthy environment, the foundation for environmental sustainability and climate action. Furthermore, it enshrines key principles such as transparency, accountability, prudent use, and equitable distribution of resources, which are essential for participatory resource management, financing of green projects, and sustainable infrastructure.
2. ii) The Public Private Partnerships Act, CAP 430, Laws of Kenya, which provides the framework for the financing, construction, development, operation, and maintenance of infrastructure or development projects where projects require the structured collaboration of government and private investors. It also establishes a structured process for risk allocation and financing mechanisms, all of which are crucial for infrastructure and green projects.

iii) The Movable Property Security Rights Act, CAP 499A, Laws of Kenya (the MPSRA), which establishes the legal framework for securing financing through movable assets, offering an alternative to immovable property-backed financing. The MPSRA also prescribes a comprehensive mechanism for the enforcement of security rights in favour of a creditor, thereby strengthening access to finance; and

1. iv) The Insolvency Act, CAP 53, Laws of Kenya, which outlines processes for efficient and equitable administration of entities or natural persons in financial distress, aiming to secure better outcomes for lenders and investors. In the context of climate finance, investors and stakeholders in sustainable finance ventures are more confident about their long-term commitments, noting that risks and losses can be mitigated through insolvency procedures.

Collectively, these statutes create a solid foundation for secure and transparent project financing in Kenya.

 

Regional and Continental Trends in Climate Finance

Regionally, the African Continental Free Trade Area (AfCFTA), together with Africa’s broader climate objectives, is promoting cross-border climate investment and facilitating new opportunities. However, this development has also introduced multi-jurisdictional regulatory complexities that require particular expertise to navigate disparate national policies effectively.

Within sub-Saharan Africa, and particularly in Kenya, climate finance is evolving in response to localised needs and emerging regional frameworks. Kenya has made significant strides, with strong legal and political commitment embodied in legislation such as the Climate Change Act, CAP 387A, Laws of Kenya, which has provided an overarching statutory framework for the development, regulation, and implementation of mechanisms geared towards enhancing the country’s climate resilience and carbon market development.

To complement this, Kenya also developed the Kenya National Adaptation Plan (2015-2030) and the broader strategic frameworks aligned with the Vision 2030 blueprint. Collectively, these frameworks have embedded climate change mitigation and adaptation within the national development agenda, fostering an enabling environment to mobilise climate finance resources targeting Kenya’s unique vulnerabilities and enhancing climate resilience for sustainable economic growth.

Further, the launch of the Kenya Green Finance Taxonomy (KGFT) and climate risk disclosure frameworks marks a major milestone in Kenya’s green finance architecture. The KGFT has provided a comprehensive classification system designed to standardise and define the financial activities in alignment with Kenya’s environmental and development objectives. It classifies environmentally sustainable economic activities to guide investment decisions, combat greenwashing by ensuring transparency and accountability, and align the financial flows with Kenya’s NDCs. In doing so, it boosts investor confidence and attracts both domestic and international capital towards the achievement of a climate-resilient economy.

In many developing countries, including Kenya, challenges such as underdeveloped capital markets and limited institutional capacity can hinder the flow of private capital. However, through the ongoing alignment of legislation and policy, Kenya is creating an environment that supports both conventional and green project finance, which will unlock funding streams that advance sustainable priorities.

The KGFT has exemplified the efforts to standardise definitions and reporting, thereby enhancing transparency and boosting investor confidence; trends we believe shall influence risk profiles and structuring considerations in future green deals.

 

Strategic Imperatives to Navigate Climate Finance

Stakeholders engaged in climate finance transactions must adopt a holistic approach to mitigate the risks commonly associated with such investments. First, rigorous due diligence must be undertaken at the outset to identify potential regulatory, environmental and technical risks. These may include issues such as uncertain land tenure, weak institutional governance, or technological feasibility.

Contracts and supporting documentation must be precisely structured to account for the allocation of risk and liability among stakeholders, especially in cases of project failure, cost overruns, or force majeure events. Moreover, the covenants, obligations of the respective parties, and remedies available in the event of default should be clearly highlighted. The incorporation of binding ESG performance covenants relating to the project should also be carefully considered and critically outlined.

Parties seeking to engage local or international actors in financing and implementation of green projects should effectively negotiate and evaluate co-investment strategies, including guarantees, to mitigate risk perception and enhance project bankability.

Overall, embedding integrated strategic measures and regulatory parameters into green project financing will safeguard investor confidence, unlock climate capital, and create long-term value for communities and stakeholders.

 

Conclusion

The challenge of climate finance is multidimensional, involving regulatory gaps, capital markets, policy design, institutional capacity, and social equity concerns. Yet, in the midst of these challenges lies a profound opportunity to reimagine development in a way that is sustainable, inclusive, and resilient.

In many developing countries, including Kenya, challenges such as underdeveloped capital markets and limited institutional capacity can hinder the flow of private capital. However, through the ongoing alignment of legislation and policy, Kenya is creating an environment that supports both conventional and green project finance, which will unlock funding streams that advance sustainable priorities.

Addressing these challenges requires coherence across institutions, innovation in financial structures, and trust among stakeholders. A robust ecosystem – comprising national governments, development finance institutions (DFIs), financial institutions, public benefit organisations, and academia – is essential to designing, funding, and implementing impactful climate projects.

With the right strategies, tools, and partnerships in place, climate finance can become a powerful engine for transformation – driving the world not only toward net-zero emissions but also toward a future that is just, prosperous, and resilient for all.