The Data Arbitrage: Kenya Is Factoring eCitizen Data into Its Revenue Budget

The State House has found a new line item for its revenue sheets: your digital footprint.

The Draft Final National Data Governance Policy, May 2026, reveals that the Ministry of Information, Communications and the Digital Economy plans to launch a commercial National Data Marketplace. Corporations, researchers, and NGOs will be able to purchase aggregated government datasets collected through platforms like eCitizen. The rollout is scheduled for July 2026 pending Cabinet approval. A new National Data Governance and Emerging Technologies Council will oversee the sale of at least 1,000 datasets over five years, at a setup cost of KES 396 million to taxpayers.

The official assurance is that all personal data: names, ID numbers, phone numbers, biometric photos, will be scrubbed before sale, in line with the Data Protection Act of 2019. Strapped for cash and under pressure to service sovereign debt, the state is turning civic records into a commercial inventory. The compliance framing does not change what that is.

The Anonymisation Problem

The marketplace will sell datasets tracking land transaction volumes, vehicle ownership distributions, passport application densities, and localised birth and death rates. A single dataset looks anonymous. Cross-reference land records from the Ministry of Lands with vehicle registration timelines from the NTSA and eCitizen login frequencies and the line between an aggregated demographic and an identifiable individual disappears. The policy also explicitly permits these datasets to train commercial AI models, meaning private developers can build proprietary, revenue-generating software on data that citizens had no choice but to generate when accessing basic public services.

The Structural Risks

Centralising records from every ministry and county into a single commercial API gateway creates an obvious target for cybercriminals. A breach cascades across every integrated public ledger simultaneously. The draft policy contains no legal liability framework specifying who is accountable if a commercial partner leaks or misuses the data.

The proposal also puts two government bodies on a collision course. The ODPC was built to protect citizen privacy. The new Council is being measured on sales volume. Forcing a privacy watchdog to police a sister agency with a statutory mandate to sell public data is a conflict of interest baked into the architecture.

This policy will face legal challenge when it hits Cabinet in July. Forcing citizens to digitise their lives on eCitizen under threat of exclusion from public services, then selling those records to corporate buyers.