The Government of Kenya is committed to protecting the privacy and personal data of every citizen who uses the eCitizen digital services portal. This Privacy Policy explains how we collect, use, store, and safeguard your personal information in compliance with the Kenya Data Protection Act 2019 and all subsidiary regulations made thereunder. By using eCitizen, you acknowledge that you have read and understood this policy.
1. Information We Collect
We collect personal information that is necessary to provide you with government services. The categories of information we collect include:
Identity & Contact Information
- National Identification Number (National ID or Passport Number)
- Full legal name as it appears on government-issued identification
- Email address and mobile phone number
- Physical address and county of residence
- Date of birth and gender
Service & Transaction Data
- History of government service applications submitted through eCitizen
- Payment records, M-PESA transaction references, and fee receipts
- Uploaded supporting documents (e.g., photographs, certificates)
- Application status updates and correspondence records
Technical & Usage Data
- IP address and approximate geolocation derived from it
- Browser type, version, and operating system
- Pages visited, session duration, and navigation patterns
- Device identifiers for mobile application users
2. How We Use Your Information
Personal information collected through eCitizen is used exclusively for the following purposes:
- Processing your government service applications and issuing documents or permits.
- Verifying your identity against national databases to prevent fraud and impersonation.
- Sending transactional notifications such as application status updates, payment confirmations, and document readiness alerts via SMS and email.
- Improving the platform through aggregated, anonymised analytics to understand usage patterns and service bottlenecks.
- Complying with our legal and regulatory obligations as a government entity, including audit and record-keeping requirements.
- Detecting, investigating, and preventing fraudulent transactions and other illegal activities.
3. Legal Basis for Processing
Under the Kenya Data Protection Act 2019, we process your personal data on the following lawful bases:
| Legal Basis | When Applied |
|---|---|
| Consent | When you voluntarily provide optional information (e.g., newsletter subscription preferences) or enable optional analytics cookies. |
| Contractual Necessity | To create and manage your eCitizen account and process the government services you have requested. |
| Legal Obligation | Where we are required by Kenyan law to collect, retain, or disclose personal data, including tax obligations and public records laws. |
| Public Interest | For tasks carried out in the exercise of official government functions, including identity verification and national statistics. |
4. Data Sharing
We do not sell your personal data to any third party under any circumstances. We may share your information only in the following limited circumstances:
- With the specific government agency or department responsible for processing your service request (e.g., sharing your data with NTSA when you apply for a driving licence).
- With courts, tribunals, law enforcement agencies, or regulatory bodies where we are legally compelled to do so by a court order, subpoena, or applicable law.
- With payment service providers (such as the Central Bank of Kenya-licensed payment processors) solely to facilitate transaction processing.
- With authorised data processors who act on our behalf under strict data processing agreements and are bound by the same data protection obligations.
5. Data Retention
We retain your personal data only for as long as is necessary for the purposes stated in this policy or as required by Kenyan law. Our retention schedule is as follows:
Active Account Data
Duration of accountYour profile information and linked documents are retained for as long as your eCitizen account remains active.
Service Application Records
7 yearsRecords of all government service applications are retained for seven years in accordance with the Kenya Government Records Management Policy.
Payment Transaction Records
7 yearsFinancial transaction records are retained for seven years as required by the Central Bank of Kenya regulations.
System Audit Logs
5 yearsSecurity and access audit logs are retained for five years to support cybersecurity investigations and compliance audits.
Deleted Account Data
90 daysUpon account deletion, your data is anonymised within 90 days. Some records may be retained longer where legally required.
6. Your Rights Under the Kenya Data Protection Act
The Kenya Data Protection Act 2019 grants you the following rights with respect to your personal data. You can exercise any of these rights by contacting our Data Protection Officer (see Section 11).
Right to Access
Request a copy of the personal data we hold about you.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your data where there is no compelling reason for its continued processing.
Right to Object
Object to the processing of your data for purposes based on public interest or legitimate interests.
Right to Portability
Receive your data in a structured, machine-readable format and transfer it to another controller.
Right to Restrict Processing
Request that we limit how we use your data while a complaint or query is being resolved.
To exercise your rights, contact the Data Protection Officer at dpo@ecitizen.go.ke. We will respond to your request within 21 days as required by the Act. If you are dissatisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.
7. Cookies
eCitizen uses cookies and similar technologies to ensure the platform functions correctly and to understand how citizens use our services. We use the following types of cookies:
Strictly Necessary Cookies
RequiredSession cookies required for authentication and to maintain your logged-in state. These cannot be disabled as the platform cannot function without them.
Analytics Cookies
OptionalUsed to understand how citizens navigate the platform, identify popular services, and detect errors. Data is aggregated and anonymised. You can opt out via the Cookie Preferences link in the footer.
Third-Party Tracking Cookies
RequiredeCitizen does not use third-party advertising or tracking cookies. No citizen data is shared with advertising networks.
8. Security
The Government of Kenya takes the security of your personal data seriously. We implement a layered approach to security comprising:
- SSL/TLS encryption for all data in transit between your device and our servers.
- AES-256 encryption for all personally identifiable information stored in our databases.
- Data centres certified to ISO 27001 Information Security Management System standard.
- Regular independent security audits and penetration testing conducted at least annually.
- Multi-factor authentication (MFA) required for all administrative access to production systems.
- Role-based access controls ensuring staff can only access data necessary for their function.
- Automated intrusion detection systems with 24/7 security monitoring.
In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within 72 hours and notify affected citizens without undue delay, as required by law.
9. Children
eCitizen services are intended for persons aged 18 years and above. Minors under the age of 18 may not create an independent eCitizen account. However, a parent or legal guardian may apply for government services on behalf of a minor child (for example, applying for a child's birth certificate or minor's passport), provided the guardian is the registered account holder and provides the required parental or guardian consent documentation. In all such cases, it is the guardian's responsibility to ensure the accuracy of information submitted on behalf of the minor.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in law, technology, or our service offerings. For material changes that significantly affect your rights or how we use your data, we will provide at least 30 days' prior notice by sending an email to the address registered on your eCitizen account. The updated policy will be published on this page with a revised "Last updated" date. We encourage you to review this policy periodically. Continued use of the platform after the effective date of changes constitutes your acceptance of the revised policy.
11. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact our Data Protection Officer:
Data Protection Officer
eCitizen Support Command Centre
Telposta Towers, Kenyatta Avenue
P.O. Box 27150-00100, Nairobi, Kenya
Email: dpo@ecitizen.go.ke
Toll-Free: 0800 221 000