Kenya's Plan to Monetise eCitizen Data Starts in July. Here Is What Actually Goes on Sale and What the Anonymisation Promise Actually Means

That is the idea at the centre of Kenya's Draft Final National Data Governance Policy, published in May 2026 by the Ministry of Information, Communications and the Digital Economy. PS Eng. John Tanui confirmed in the policy's preface that implementation begins in July 2026 on a phased basis. Phase one is standards and capacity building. Phase two is the marketplace.

The plan is this: a new body called the National Data Governance and Emerging Technologies Council will aggregate datasets from eCitizen and other state systems, strip out personal identifiers, and make the rest available for purchase through a centralised marketplace. At least 1,000 datasets over five years. The build cost is KES 396 million ($3.1M), split between a KES 185 million marketplace and KES 211 million for government data product development. Cabinet Secretary William Kabogo Gitau called data "a strategic national asset." The policy draft literally uses the phrase "the new oil."

What goes on sale? Business registration volumes by county. Passport application trends by region. Vehicle registration statistics. Land transaction data. Birth, death, and marriage registration trends. Agricultural production by region. Traffic flow patterns. The government insists that names, phone numbers, national ID numbers, and photographs will never be included. Only anonymised, aggregated datasets, in compliance with the Data Protection Act 2019.

There are two separate problems with that guarantee, and they are worth taking seriously.

The first is technical. Anonymisation and unidentifiability are not the same thing. Data researchers have demonstrated repeatedly that stripping personal identifiers from aggregate datasets does not make them impossible to reverse. Combine land transaction location data with passport application volumes by county and birth registration trends, and in smaller counties with distinct demographic patterns, you can often narrow a population down to identifiable individuals or households. The Data Protection Act requires data protection impact assessments for high-risk processing. The policy as published does not confirm whether one has been commissioned. The Office of the Data Protection Commissioner has not publicly commented.

The second problem is institutional. Kenya's Public Accounts Committee described eCitizen as a "crime scene" in August 2025 following the Auditor General's special report. Auditor General Nancy Gathungu found over KES 9.6 billion in questionable transactions in the financial year ending June 2024. KES 7.05 billion sat in collection and settlement accounts with no legally binding agreements governing it. KES 2.57 billion in Pesaflow receipts had no matching invoices. Four transactions from the official government paybill were diverted to private accounts in January 2024. PAC Chairperson Tindi Mwale: "We must admit that we should not be using this system. It has no legal backing whatsoever."

The government is now proposing to commercialise data generated through a platform whose Auditor General cannot account for KES 9.6 billion in a single year.

The marketplace itself may be commercially modest. The US comparison the government invokes does not translate cleanly. American states generate hundreds of millions from selling DMV records because that data includes personal identifiers such as names, addresses, and phone numbers. Kenya's version specifically excludes personal data, which is the right legal call, but it also dramatically limits what buyers will pay. Aggregate crop production statistics and passport application trends are useful for researchers and urban planners. They are not the high-value product that makes a government data marketplace financially significant.

None of that makes the direction wrong. Kenya genuinely sits on government data that agricultural lenders, insurance companies, and infrastructure planners need and currently pay private vendors to approximate. A properly governed marketplace, built on clean data and robust anonymisation standards, could serve those needs. The question is sequencing. Trust in eCitizen has to be rebuilt before its data becomes a product you charge for. The July 2026 implementation date makes that sequencing very tight.