Kenya’s ODPC Draft Guidance Note for Private Security: What You Need to Know

A. Background

Private security operations commonly involve protecting premises, assets, businesses, residences, and individuals. Private security service providers increasingly rely on technologies such as CCTV surveillance, biometric systems, and access control mechanisms. The reliance on surveillance and identification technologies can be used when conducting background checks, managing access to secure areas, and investigating security incidents. All these involve collection, recording, storage and use of personal data including sensitive personal data.

The Office of the Data Protection Commissioner (ODPC) has issued a Draft Guidance Note for Private Security in December 2025. The Guidance provides a sector-specific direction on how such data processing should be conducted in compliance with Kenya’s data protection framework.

The Draft Guidance Note applies to a very wide range of activities. It predominantly targets security-related services offered by the individuals and companies involved in activities including safeguarding a property or individuals and guarding safety and order; security consultants; bodyguards; private investigators; security advisors; and providers of locksmith services.
Besides it applies to manufacturers and distributors of security equipment; employers; property owners and property management companies; and technology providers and system integrators.
Although the guidance is currently in draft form, it has progressed past the consultation stage and is expected to provide important regulatory direction for the sector once formally adopted.

B. Summary of the Guidance

The Guidance Note provides practical advice on how private security service providers and related actors should handle data in compliance with the Data Protection Act, 2019 when processing personal data while providing security services. It has two primary aims. One, it provides practical advice on how the service providers should go about their private security activities while also offering guarantee for the protection of interests of the individuals whose personal data is collected and used. Two, it guides how the actors should manage risks associated with collection of data, data sharing, lack of transparency, as well as cybersecurity concerns. The substantive guidance in the Draft Guidance Note complements the compliance standards in the existing governing framework for the private security industry which includes the Private Security Regulation Act, 2016 and the Private Security (General) Regulations, 2019.

The ODPC guidance therefore clarifies:

• The application of data protection principles under the Data Protection Act, 2019 to private security operations.
• The lawful bases for processing personal data in security contexts.
• The obligations of private security service providers when deploying surveillance systems and biometric technologies.
• Measures that should be taken to ensure that personal data collected through security systems is handled lawfully, fairly and transparently.

The guidance also seeks to ensure that security operations do not unnecessarily infringe on privacy rights, while allowing organisations to maintain legitimate security measures.

C. Who is Affected

The Draft Guidance Note is relevant to a range of actors involved in private security operations and the deployment of security technologies. These include:

1. Private security service providers offering services such as surveillance and monitoring of premises; alarm response services; access control systems; event and VIP security; and cash-in-transit service.
2. Organisations and property owners that deploy private security systems or engage private security service providers to monitor their premises.
3. Technology providers and system integrators involved in installing or managing security technologies such as CCTV systems, biometric identification systems (including fingerprint or facial recognition technologies); and other surveillance and monitoring technologies.
4. Employers and organisations that use surveillance or biometric technologies for security or access control within workplaces or facilities.

However, the guide does not affect government agencies such as the military. Also, the Guidance does not apply to the use of private security for household application.

D. Practical Impact

The Draft Guidance Note signals increased regulatory attention to the processing of personal data within the private security industry, particularly where surveillance and biometric technologies are involved.

The Note:

1. Clarifies the governance of security technologies such as CCTV surveillance and biometric identification systems in the security sector and ensuring they comply with the requirements of the Data Protection Act, 2019 and applicable regulations.
2. Clarifies the registration and data protection impact assessment obligation of the affected actors.
3. Reinforces that security objectives must be balanced with rights to privacy and data protection.
4. Clarifies the additional data protection considerations such as data protection by design and default mechanism in the private security industry in Kenya.

E. Required Compliance Actions and Obligations

The Draft Guidance Note outlines several practical compliance considerations for organisations involved in private security operations.

1. Mandatory registration with the ODPC: Private security agencies providing CCTV technology, entities contracted to install or maintain such systems, as well as building or property management companies that deploy or manage CCTV systems are required to register with the ODPC as data controllers and/or data processors where they process personal data through these technologies. The registration obligation also extends to the building and property management companies. This registration is mandatory regardless of the entity’s size, annual turnover, or revenue.
2. Establishing a lawful basis for processing: Organizations must identify a lawful basis for collecting personal data and ensure that personal data collected through security operations is processed based on a valid lawful basis under the Data Protection Act 2019. The private security agencies can rely on the ‘legal obligation’ as a lawful basis of collection pursuant to section 48 of the Kenyan Private Security Regulation Act, 2016. Others possible lawful bases can be consent, legitimate interest, and public interests.
3. Applying data protection by design and by default: Besides the common technical and organizational measures, the ODPC Guidance Note advises private security firms that rely on manual processing of visitor’s records to adopt mechanisms for restricted access, limited use, auditing and disposal of the logbook.
4. Applying data protection principles: Private security providers should ensure that their operations adhere to the core data protection principles, including lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy accountability, storage limitation, integrity, and confidentiality.
5. Performing a data protection impact assessment: Where technologies such as CCTV or biometric access systems (using fingerprint and facial technologies) are deployed, organizations should assess the impact on fundamental rights and freedoms and consider less intrusive means to achieve their legitimate purpose of the processing. The DPIA mechanism is aimed at ensuring that their use is necessary, proportionate, and appropriate for the intended security objective.
6. Ensuring transparency: Individuals should be clearly informed where surveillance systems are in use, including the purpose of monitoring and how the collected data will be used and retained. This can be done through a prominent notice at the entrance/gate of a building.
7. Facilitating data subject rights: Organizations should establish procedures that allow individuals to exercise their rights under the Data Protection Act 2019, including the right to be informed; right to access personal data collected through surveillance systems and held by private security companies; right to object; right not to be subjected to automated decision-making; erasure (right to be forgotten); rectification; and data portability. Notably, the Guidance Note clarifies that the standards of portability also require the private security agencies to enable porting of access logs to third parties such as lawyers.
8. Training and communication protocols/Channels: Private Security Service Providers should conduct regular training of staff, communicate to them the need to take ownership of their work and be accountable for their actions. This should be complemented by establishing clear lines of reporting and escalation for data protection issues.
9. Other mechanisms: Private security agencies should have in place proper data breach management mechanisms as well as contractual and due diligence mechanisms for engagement of a data processor.

F. Effective Dates and Next Steps

1. Current status
   The Guidance Note is currently in draft form, though it has already progressed beyond the consultation stage.
2. Next steps
   Once formally adopted by the ODPC, the guidance is expected to provide authoritative direction on how private security service providers and organizations using manual systems and deploying security technologies should comply with Kenya’s data protection framework.
3. Monitoring developments
   Organisations operating in the private security sector should monitor developments relating to the final adoption of the guidance. In anticipation, they should begin reviewing their surveillance and security practices to ensure alignment with the proposed expectations.