President William Ruto has nominated Lydia Sitienei Chelagat to serve as Kenya’s next Data Commissioner, setting in motion a parliamentary approval process that will determine who leads the country’s privacy regulator for the next six years.
The nomination was announced on Monday, November 9, in a statement issued by Government Spokesperson Charles Owino. According to the statement, Ruto acted on the recommendation of the Public Service Commission and in exercise of constitutional powers vested in the Head of State.
Chelagat’s name has been forwarded to the National Assembly for consideration in line with the Data Protection Act, Cap 411C.
“The nomination has been transmitted to the National Assembly for consideration, in fulfilment of the legal requirements set out under the Data Protection Act, Cap 411C, Laws of Kenya,” the statement read.
Until her nomination, Chelagat served as Director of Legal Services and Corporation Secretary at the Communications Authority of Kenya (CA). She emerged from a competitive field of 152 applicants, from which the Public Service Commission shortlisted 13 candidates in September 2026.
Among those shortlisted were Media Council of Kenya CEO David Omwoyo and John Walubengo, a senior deputy at the Office of the Data Protection Commissioner.
If approved by Parliament, Chelagat will succeed Immaculate Kassait, Kenya’s inaugural Data Commissioner, whose single, non-renewable six-year term expires in mid-November 2026.
Kassait was appointed in November 2020 following the operationalisation of the Office of the Data Protection Commissioner (ODPC) under the Data Protection Act of 2019.
The incoming commissioner will inherit an institution that has grown significantly in mandate and visibility since its founding.
The ODPC is tasked with enforcing the Data Protection Act, investigating complaints related to privacy violations, and supervising how both public and private entities collect, process and safeguard personal information.
Kassait’s tenure saw the establishment of the office’s first strategic plan and the development of data protection regulations.
However, the next commissioner will face mounting pressure to enforce compliance as data-driven technologies, including artificial intelligence, become more deeply embedded in Kenyan society.
Chelagat’s background at the Communications Authority, a regulator accustomed to overseeing telecommunications and digital infrastructure, may signal a continuation of the ODPC’s regulatory approach.
However, her nomination is not yet final. The National Assembly must vet and approve her appointment before she can assume office, a process that mirrors the one Kassait underwent in 2020.
The statement from the Government Spokesperson did not indicate when parliamentary consideration would take place.
The Office of the Data Protection Commissioner was established under the Data Protection Act, 2019, which gave institutional effect to the constitutional right to privacy under Article 31 of the Constitution.
The Act created a framework for the registration of data controllers and processors, mandated compliance audits and empowered the commissioner to impose administrative fines for noncompliance.
Kassait, the office’s first holder, came to the role after a decade at the Independent Electoral and Boundaries Commission, where she served as Director of Voter Registration and Electoral Operations. She was sworn in on November 16, 2020.
