Data Protection in Kenyan Churches: Understanding Your Legal Obligations

At GlideMission, we believe that empowering the Church goes beyond providing technology. It also means equipping church leaders with the knowledge they need to manage church operations responsibly and in accordance with the law. We are committed to raising awareness of data protection and privacy obligations affecting churches in Kenya. Below are key legal provisions, relevant court decisions, and practical insights to help your church better understand its responsibilities and take informed steps towards compliance.

What Every Church Leader Should Know About Data Privacy, Kenyan Law and Compliance

The Church is built on faith, fellowship, trust, and service. Every day, churches collect and manage information that helps them minister to their congregations, communicate with members, coordinate activities, and manage church resources.

From membership registers and contact details to financial contributions, children's records, prayer requests, photographs, and pastoral information, churches handle personal

Data protection is not simply a technology issue or an administrative preference. It is a legal responsibility that forms part of good governance, accountability, and responsible ministry.

In this article, we examine the legal framework governing data protection in Kenya, relevant court decisions, and practical steps churches can take to protect personal information and strengthen compliance.

1. What Does Kenyan Law Say About Data Protection?

Kenya has an established legal framework governing the protection of personal information.

The principal legal instruments include:

The Constitution of Kenya, 2010

Article 31 of the Constitution guarantees the right to privacy. In particular, Article 31(c) protects individuals against the unnecessary disclosure of information relating to their family or private affairs, while Article 31(d) protects the privacy of communications.

These protections are relevant to the information churches collect and maintain, including pastoral counselling records, prayer requests, children's information, membership details, and financial records linked to identifiable individuals.

The Data Protection Act, No. 24 of 2019

The Data Protection Act gives effect to Article 31(c) and (d) of the Constitution. It establishes the legal framework for regulating the processing of personal data and provides for the rights of data subjects and the obligations of data controllers and data processors.

The Act applies to organisations processing personal data within its scope, including religious institutions.

The Data Protection Regulations, 2021

The Act is supplemented by regulations that provide further requirements relating to personal data processing, registration, complaints handling, and enforcement.

These include:

• Data Protection (General) Regulations, 2021.

• Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.

• Data Protection (Complaints Handling and Enforcement) Regulations, 2021.

The Office of the Data Protection Commissioner (ODPC) oversees the implementation and enforcement of Kenya's data protection framework.

Importantly, the ODPC identifies faith-based and religious institutions among the categories that are not exempt from mandatory registration as data controllers or data processors, regardless of annual revenue or employee numbers.

Churches should therefore not assume that their religious or nonprofit status automatically exempts them from data protection requirements.

2. Why Does Data Protection Matter to Churches?

Churches are entrusted with more than financial resources and ministry responsibilities. They are also entrusted with personal information that may be private, confidential, or sensitive.

Consider the information a church may handle:

• Members' names, telephone numbers, addresses, and family details.

• Children's registration and Sunday school records.

• Tithes, offerings, donations, and campaign contributions.

• Prayer requests and pastoral counselling information.

• Photographs and videos from church services and events.

• Staff, volunteers, and ministry leadership records.

• Health information and other sensitive details shared for pastoral care.

• Attendance records and information about participation in church activities.

If this information is lost, disclosed inappropriately, or accessed without authorisation, it may affect individuals and undermine confidence in church leadership.

Responsible data management helps churches protect privacy, strengthen accountability, maintain trust, and fulfil their legal responsibilities.

Protecting personal information is not only about complying with the law; it is also about honouring the trust placed in the Church.

3. Does Your Church Need to Register with the ODPC?

This is an important question for every church operating in Kenya.

Section 18 of the Data Protection Act provides the statutory framework for the registration of data controllers and data processors. The applicable registration requirements are further addressed in the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.

The ODPC identifies faith-based and religious institutions as a category that is not exempt from mandatory registration, regardless of annual revenue or the number of employees.

Church leadership should assess the applicable requirements and establish whether the church must register as a data controller, a data processor, or both.

Understanding the Difference

Data Controller

A data controller determines the purposes for which personal data is processed and the means of processing it.

For example, a church that determines what membership information to collect, why it is needed, and how it will be used will generally act as a data controller for that processing.

Data Processor

A data processor processes personal data on behalf of a data controller under the relevant arrangement.

For example, a technology provider managing church records on behalf of a church may act as a data processor, depending on its actual role and the contractual arrangements in place.

An organisation may act as a controller, a processor, or both in different circumstances. Churches should assess their actual activities rather than relying on the organisation's name or the type of software it uses.

It is also important to understand that registration alone does not amount to full compliance. Churches must implement appropriate policies, safeguards, and procedures for handling personal information.

4. Key Legal Obligations for Churches Under the Data Protection Act

The Data Protection Act establishes principles and requirements that organisations must consider when processing personal data.

The following provisions are particularly relevant to church administration.

A. Section 25: Principles of Personal Data Processing

Section 25 establishes key principles governing the processing of personal data.

Among other requirements, personal data should be processed lawfully, fairly, and transparently; collected for explicit, specified, and legitimate purposes; limited to what is necessary; maintained accurately; and retained only for as long as necessary, subject to applicable legal requirements.

What this means for churches:

Churches should be able to explain why they collect particular information, how it will be used, who may access it, and how long it needs to be retained.

Information should not be collected simply because it might be useful in the future.

B. Sections 29 and 30: Information and Lawful Processing

Section 29 addresses the information that should be provided when collecting personal data. Section 30 establishes the framework for lawful processing.

When registering members, visitors, staff, or volunteers, churches should explain the purpose of collecting information and identify an appropriate lawful basis for processing it.

For example, a church may need contact details to communicate service schedules or administrative notices. The collection and use of those details should be consistent with the applicable legal requirements and the purpose communicated to the individual.

Churches should not assume that participation in church activities automatically authorises every possible use of an individual's information.

C. Sections 26 and 32: Data Subject Rights and Consent

Section 26 sets out rights of data subjects, while section 32 addresses conditions relating to consent.

Individuals have rights concerning their personal information, including the right to be informed about its use, access their data, object to certain processing, and seek correction or deletion of false or misleading data, subject to the applicable legal provisions.

Consent is important in circumstances where it is the appropriate legal basis, but it is not the only possible lawful basis for processing personal data.

Churches should therefore assess the appropriate legal basis for each processing activity rather than assuming that consent is always required or that consent automatically makes every use lawful.

Where consent is relied upon, the applicable requirements should be observed.

D. Protecting Sensitive Personal Data

Church records may reveal religious beliefs, health information, family circumstances, and other sensitive matters.

The Data Protection Act establishes specific conditions for processing sensitive personal data. Section 45 contains provisions relevant to certain processing by qualifying religious or nonprofit bodies in connection with their legitimate activities.

However, these provisions are conditional. Churches should not interpret them as a blanket exemption from data protection obligations or as unrestricted permission to disclose sensitive information.

Appropriate safeguards and the applicable legal conditions must be observed.

E. Section 41: Data Protection by Design or Default

Section 41 addresses data protection by design or default.

Churches introducing digital systems should consider privacy and security from the outset rather than treating them as matters to address only after a problem occurs.

For example, a church management system should be configured so that finance personnel, ministry leaders, administrators, and other users can access only the information appropriate to their responsibilities.

F. Section 43: Personal Data Breaches

Section 43 addresses personal data breach notification obligations.

Where a breach occurs, the applicable notification requirements depend on the circumstances and statutory conditions. Churches and their technology providers should understand their respective responsibilities and establish procedures for identifying, reporting, assessing, and responding to incidents.

A church should not wait until a serious incident occurs before deciding who is responsible for managing it.

5. What Kenyan Court Decisions Tell Us About Data Protection

Kenyan courts have considered disputes involving the Data Protection Act, the ODPC's statutory mandate, and the constitutional right to privacy.

Although the decisions below are not church-specific judgments, they provide useful context for understanding the legal framework in which churches operate.

Case 1: Gichuhi & 2 Others v Data Protection Commissioner; Mathenge & Another (Interested Parties) [2023] KEHC 17321 (KLR)

In this High Court judicial review matter, the applicants challenged a decision by the Data Protection Commissioner concerning a complaint involving the sharing of court documents by a former employee.

The Court considered, among other issues, the statutory timeframe for determining complaints under section 56(5) of the Data Protection Act. It held that the Commissioner's decision in question had been made outside the statutory timeframe and was invalid.

The judgment also discussed the constitutional right to privacy under Article 31 and the role of the Data Protection Act in giving effect to that right.

Why this matters to churches

The decision demonstrates that data protection disputes are governed by statutory requirements and that the exercise of regulatory powers must remain within the law.

Churches should establish appropriate internal procedures for handling privacy concerns and complaints, while recognising that the law also prescribes processes and timelines for the regulator.

The case does not establish a church-specific compliance rule; its relevance lies in the broader statutory and constitutional framework.

Case 2: Republic v Kithure Kindiki, Cabinet Secretary, Ministry of Interior & Coordination of National Government & Another; Katiba Institute (Ex parte); Office of the Data Protection Commissioner & 3 Others (Interested Parties) [2024] KEHC 1649 (KLR)

This High Court judicial review matter concerned proceedings relating to the national digital identification project known as Maisha Namba.

The proceedings addressed issues including the Data Protection Impact Assessment associated with the project and the circumstances surrounding earlier court orders.

The judgment discusses the statutory role of the ODPC and the assessment of data protection requirements in the context of a large-scale public digital identity initiative.

Why this matters to churches

Churches introducing new technologies should assess the privacy implications of the personal information they collect and process.

Where processing is likely to result in a high risk to individuals' rights and freedoms, a Data Protection Impact Assessment may be required under section 31 of the Data Protection Act.

Churches considering biometric attendance systems, extensive profiling, or other high-risk processing should assess the applicable requirements before implementation.

This decision concerned the national identification project and should not be interpreted as a judgment specifically determining church compliance.

The Broader Legal Position

These decisions should be read alongside the Constitution, the Data Protection Act, and the applicable regulations.

They do not replace the legislation or mean that every church has identical obligations in every circumstance.

The practical position is that churches should identify the personal information they process, determine their applicable legal obligations, assess registration requirements, implement appropriate safeguards, and maintain procedures for responding to data protection requests and incidents.

6. Common Data Protection Mistakes Churches Should Avoid

Even churches with good intentions can expose personal information through everyday practices.

Common examples include:

Sharing membership lists unnecessarily: Circulating spreadsheets containing personal details among people who do not need access.

Publishing photographs without appropriate consideration: Posting images of children, visitors, or church members without addressing applicable privacy, consent, and safeguarding requirements.

Using shared login credentials: Allowing multiple people to access a system through one account, making it difficult to manage permissions and trace changes.

Leaving records unsecured: Keeping printed registration forms in accessible areas or storing digital files in folders available to too many users.

Sharing sensitive prayer requests: Circulating confidential pastoral information beyond its intended audience without an appropriate legal basis.

Failing to remove former users: Allowing former staff or volunteers to retain access to church systems after their responsibilities end.

Using digital services without checking their practices: Uploading church records to applications or platforms without understanding how the information will be handled.

Retaining information indefinitely: Keeping personal records without considering whether they are still necessary for the purpose for which they were collected.

Avoiding these practices requires clear procedures, appropriate technology, and a culture in which everyone understands their responsibility to protect information.

7. Practical Steps Towards Church Data Protection Compliance

Churches can begin strengthening their data protection practices through a structured approach.

Step 1: Identify the Information You Collect

Review the personal information held by different departments, including membership, finance, children's ministry, human resources, and pastoral care.

Understand why each category of information is collected and who uses it.

Step 2: Assess Your Registration Obligations

Review the ODPC's registration guidance and determine whether your church needs to register as a data controller, data processor, or both.

Step 3: Review Your Data Protection Policies

Develop clear procedures covering information collection, access, sharing, retention, security, and disposal.

Step 4: Review Access to Records

Ensure staff, volunteers, and ministry leaders can access only the information necessary for their responsibilities.

Step 5: Assess Your Technology

Review the church management systems, spreadsheets, email services, cloud storage, bulk SMS platforms, and other tools used to handle personal information.

Ask providers how information is protected and how responsibilities are divided between the church and the provider.

Step 6: Train Staff and Ministry Leaders

Ensure everyone handling church information understands confidentiality, appropriate information sharing, password security, and incident reporting.

Step 7: Establish an Incident Response Process

Determine who should be notified when information is lost, disclosed inappropriately, or accessed without authorisation.

Document the steps to be followed and ensure responsible personnel understand the applicable reporting requirements.

Step 8: Review Compliance Regularly

Data protection is an ongoing responsibility. Review your practices as the church grows, introduces new technologies, or changes how it collects and uses personal information.

8. Choosing the Right Church Management System

As churches grow, managing records through paper registers, spreadsheets, and disconnected applications can become increasingly difficult.

A Church Management System can help bring administrative information together and support more organised record management. However, technology alone does not guarantee compliance.

When evaluating a system, church leaders should ask:

• Does it provide role-based access controls?

• Can user permissions be reviewed and updated easily?

• Are appropriate security measures and backup procedures in place?

• Are audit trails available for relevant activities?

• Does the provider explain how personal information is processed and protected?

• Are responsibilities for data protection clearly established in the service agreement?

• Can the church retrieve its information if it changes providers?

• Are there clear procedures for addressing security incidents?

• Does the provider explain how personal data is retained, exported, or deleted when the service ends?

A suitable system should support the church's administrative needs while helping it manage information responsibly.

Church leadership should also consider whether a Data Protection Impact Assessment or other additional safeguards are required for its particular processing activities.

9. How GlideMission Supports Responsible Church Administration

At GlideMission, we believe that technology should help churches serve their congregations more effectively while encouraging responsible information management.

GlideMission brings key church administration functions together, including membership records, financial management, communication, reporting, and ministry activities.

System features such as user access controls and audit trails can help churches manage access and strengthen accountability when configured and used appropriately.

However, using a Church Management System does not automatically make a church compliant with data protection law.

Churches must also establish appropriate policies, manage user permissions, assess their registration obligations, train staff, and ensure that their handling of personal information complies with applicable requirements.

Technology providers and churches each have responsibilities, depending on their respective roles in processing personal data and the arrangements between them.

Our goal is to help churches embrace technology thoughtfully, with a clear understanding of both its benefits and responsibilities.

GlideMission — Serving the Church Through Technology.

10. A Christian Perspective on Data Protection

Beyond legal compliance, protecting personal information reflects principles of trust, stewardship, integrity, and respect.

Proverbs 11:13 (NIV) reminds us:

“A gossip betrays a confidence, but a trustworthy person keeps a secret.”

This principle is relevant to the way churches handle confidential information. People should be able to approach their church community with confidence that their personal circumstances will be treated with appropriate care and discretion.

Similarly, 1 Corinthians 4:2 (NIV) reminds us that those entrusted with responsibilities must be faithful.

Church leaders are entrusted with resources, responsibilities, and the confidence of the people they serve.

Protecting personal information is one way of demonstrating that faithfulness in everyday ministry.

Conclusion: Compliance Is Part of Responsible Ministry

Data protection is not simply a technical requirement. It is an important part of responsible church governance, pastoral care, and good stewardship.

Under Kenya's Data Protection Act, 2019, churches must understand their obligations concerning the collection, use, storage, and protection of personal information. They should also assess their registration requirements with the Office of the Data Protection Commissioner.

The Constitution, legislation, applicable regulations, and relevant court decisions form part of the legal framework within which churches should manage personal information responsibly.

By adopting appropriate policies, strengthening information security, training staff, and choosing technology carefully, churches can reduce risks, respect privacy, and build a culture of accountability.

The question is not only whether your church uses technology, but whether it manages personal information responsibly.

Let us embrace digital transformation while remaining faithful to the trust placed in us.

GlideMission — Serving the Church Through Technology.

Legal References and Further Reading

Legislation

1. Constitution of Kenya, 2010 — Article 31.

2. Data Protection Act, No. 24 of 2019 — including sections 18, 25, 26, 29, 30, 31, 32, 41, 43, 45 and 56.

3. Data Protection (General) Regulations, 2021.

4. Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.

5. Data Protection (Complaints Handling and Enforcement) Regulations, 2021.

Selected Kenyan Court Decisions

1. Gichuhi & 2 Others v Data Protection Commissioner; Mathenge & Another (Interested Parties) [2023] KEHC 17321 (KLR).

2. Republic v Kithure Kindiki, Cabinet Secretary, Ministry of Interior & Coordination of National Government & Another; Katiba Institute (Ex parte); Office of the Data Protection Commissioner & 3 Others (Interested Parties) [2024] KEHC 1649 (KLR).

Official Regulatory Resources

For the applicable legislation, regulations, registration guidance, and information on compliance, consult the Office of the Data Protection Commissioner (ODPC).

Legal disclaimer: This article is intended for general awareness and educational purposes and does not constitute legal advice. The application of data protection law depends on the circumstances and nature of the processing involved. Churches should consult the current legislation, official regulatory guidance, and a qualified Kenyan advocate or data protection professional when assessing their specific obligations.