Data Governance: Trends, Developments and Updates in Kenya and Globally

A. Introduction

2025 was a year of data governance legal reform, presenting a mixed regulatory landscape that is both fragmented and consolidated across multiple jurisdictions. This alert summarizes regional perspectives on this trend. It concludes with our expert reflections on the trends and projections for what 2026 portends for the data governance landscape.

B. United States of America

The US is a critical jurisdiction from the perspective of data governance, as it is home to the world’s most innovative big technology firms.

In 2025, the US saw a trend towards increasing sophistication in state-level governance. All 50 States introduced some form of AI legislation, while the number of States with comprehensive consumer data privacy laws rose to 20.
Some States adopted new laws. Others, such as Virginia, Oregon, Connecticut, Colorado and Kentucky, refined and updated their existing data privacy frameworks.

Most new laws or law-reform activities focused on changes to revenue thresholds (Nebraska), entry-level exemptions (New Jersey and Delaware), and the protection of sensitive personal data (Maryland).

At the federal level, President Trump issued executive orders to establish a national AI policy framework. Notably, the executive order seeks to focus on the federal level standard of AI regulation. At both the state and federal levels, there is a surge in enforcement action.

An example is the Department of Justice, which has filed multiple actions seeking to compel States to disclose voter registration data.

C. Latin America

1. Latin America continued to experience fragmentation in the data governance landscape. There have been major efforts by Latin American States to modernize their data protection frameworks, aiming to align them with Global best practices while adapting to the evolved realities of the people from the region.
2. Some Latin American States introduced new data privacy frameworks. Examples are Chile and Peru. These frameworks are largely modelled around the GDPR style while still providing a regional perspective.
3. The Brazilian Lei Geral de Proteção de Dados (LGPD) remained the key reference legislation in the region. This reference point also underwent refinements that indicated its continued maturity. The refinements continued alongside targeted enforcement actions. For example, Brazil’s Agência Nacional de Proteção de Dados (National Data Protection Authority) (ANPD) issued more than $12 million in fines in Q1 2025, targeting misuse of biometric data and poor consent practices.

D. Europe

Europe remains a key reference point, as it is a forerunner in developing and adopting regulatory instruments.
In 2025, the EU completed the open data maturity assessment, which evaluated the maturity of EU countries in open data, as envisaged by the Open Data Directive of 2024.

Another key highlight of 2025 was the digital omnibus package. This package (omnibus I and II) seeks to amend data governance instruments, including the EU AI Act. The package is at an early stage in the legislative process. As of early 2026, the omnibus I has received a provisional agreement.

The proposals in the package aim to:

1. Restrict the definition of personal data to information which can reasonably be expected to be used by the controller or a third party. This proposal aims to consolidate the findings from the EU General Court judgment in SRB v EDPS (T-557/20).
2. Clarify that organizations can rely on legitimate interests to process personal data for the deployment and operation of an AI system.
3. Create an exemption from the prohibition of processing sensitive personal data in case the dataset contains residual sensitive personal data.
4. Update cookies rules by introducing universal settings-based preference mechanisms that allow users to express consent or opt out consistently across websites and applications.
5. Adopt an EU-wide breach template and notification platform as a single entry point/portal for personal data breach reporting
6. Extend the deadline for a data breach notification from 72 to 96 hours.
7. Harmonize the data protection impact assessment guidance and template.

E. Asia

India remained the key reference jurisdiction in Asia. Its population is key to the data markets and regulation. India’s scale of recent activity makes it a significant regional benchmark.
The Digital Personal Data Protection (DPDP) Act 2023 took a major step in 2025 with the finalisation and enforcement of accompanying rules that require companies like Meta, Google, and OpenAI to limit personal data collection to what is strictly necessary, provide clear opt-out options, and comply with breach notification requirements. Beyond India, several Asian jurisdictions, including Singapore, Japan, and South Korea, continued to refine their data governance laws.

F. Africa (Kenya in Focus)
Across Africa, adoption of data protection laws and ICT regulatory reforms gained traction in 2025. As of 2025, 39 out of 55 African nations had enacted comprehensive data protection laws, with 34 establishing regulatory authorities. Kenya emerged as a jurisdiction with notable progress. 2025 presented Kenya as a jurisdiction transitioning from a permissive, informal data culture to a rights-centred regulatory regime. Its notable data governance trends were:

1. Adoption of the Kenya National AI Strategy 2025-2030
2. Adoption of the ODPC’s
   Strategic Framework and Policy Initiatives.
3. Progress in the EU Adequacy decision.
4. Regulatory clarifications through new Data Sharing Code and Data Protection Guidelines for children’s data, SMEs, historical and statistical data, and the public sector.
5. Jurisprudential developments and clarifications indicating expansive protection of personal data and growing role of compensation as a remedy for violation of standards.

G. Expert Reflections

Stellah Nekesa observes that:
2025 signals a decisive turning point in data governance. Regulators across mature and emerging markets are deliberately moving beyond debating principles to enforce accountability and pursue proactive harmonization. From the US to Brazil and India’s operationalizing of consent, DPIAs, and AI safeguards, to Kenya’s priority on data protection by design, governance, and due diligence frameworks, data is now treated as a regulated asset with real financial and legal consequences. Organizations should look to a more harmonised framework and coordinated enforcement actions across the globe.

H. Expert Projections

Dr. Nelson Otieno observes that:
2026 will continue to be a year of recalibration of data governance rulebook through refinements and amendments to the existing data governance instruments. We will also see heightened enforcement action around targeted areas of data governance compliance set by regulators. We are also likely to see heightened focus on harmonizing regulations, templates, and enforcement efforts among regulators at the state, sub-regional, and regional levels, with possible trickle-down or horizontal influence of such changes on other jurisdictions across the world.