Kenya wants to monetize its data. But at what cost?
Kenya is moving to turn public-sector data into an economic asset, with a new draft data governance policy proposing a marketplace for anonymized, non-personal national datasets.
The proposal has sparked immediate debate over whether governments should monetize national data. Critics have warned of privacy risks, security vulnerabilities, and the potential misuse of aggregated datasets. This echoes the controversy surrounding a recent Kenyan effort to tie economic aid from the US to the sharing of anonymized health data—an initiative that was ultimately blocked by Kenyan courts.
These concerns are justified. But they risk overlooking a larger shift in the global economy: as data becomes increasingly valuable, countries are grappling with how to translate it into geopolitical power.
Tech firms captured the value of data—now governments want their fair share
In 2006, British data scientist Clive Humby famously called data “the new oil”: a resource powering once-unthinkable artificial intelligence (AI) models and analytics. Two decades later, that vision has materialized. As generative AI takes the world by storm, data-rich institutions are gaining outsized leverage. Yet unlike oil, data has not become a tool of national economic power.
Instead, private companies are capturing much of the value generated by national data resources, while often relying on low-paid workers to produce sensitive information: consider Indian households in which housewives wear cameras to collect data for AI models. These practices allow private companies to extract value from a national resource, while the countries that supply the data see few tangible benefits.
Given this landscape, governments should consider how to best manage data as a national resource, and Kenya’s draft data governance policy represents an early effort to do just that. It offers an ambitious test of whether countries can turn data into economic and geopolitical leverage, much as oil-producing states once used natural resources to build national power.
As outlined in the table below, several nations already facilitate data sharing within government agencies and with the private sector (e.g., the UK, Estonia, Australia, and South Korea). Others have made select non-personal datasets publicly available (e.g., Denmark, India, and Singapore). Meanwhile, China already sells data-enhanced products and services on data exchanges.
Kenya, however, is among the few countries seeking to monetize raw, aggregated datasets, including in sensitive areas such as health. With implementation scheduled to begin in July 2026, its approach raises significant privacy, governance, and trust concerns. To position itself as a global leader in leveraging data for economic power, Kenya should therefore address three key areas of its plan.
First, consent must remain the foundation of the data economy
Consent is a cornerstone of modern data governance. Regulations like the EU’s General Data Protection Regulation, Kenya’s Data Protection Act, and South Africa’s Protection of Personal Information Act emphasize that individuals should understand how their data is used and retain meaningful control over it (although exemptions exist for “public interest” tasks). Singapore’s financial data exchange lets users decide which entities can access their financial information, while Brazil’s wallet turns consent into a commercial transaction, letting users accept or reject a price bid for their data.
Kenya’s proposed approach to consent, however, reveals an unresolved tension. On one hand, the policy calls for a “granular, revocable, auditable consent architecture (inspired by India’s DEPA model) for meaningful individual control,” reflecting an individual-centric model of consent. On the other hand, the policy treats non-personal and anonymized data as a strategic national asset, relying on institutional governance rather than individual consent to manage its use. This raises two questions. First, when does personal data become sufficiently anonymized to be treated as non-personal data—and who makes that determination? Second, if data was collected to deliver public services, does anonymization automatically legitimize its reuse for commercial purposes?
If Kenya is to build a data economy, it needs clear rules on how data moves from personal to non-personal, who certifies that transition, and what accountability mechanisms apply if “anonymized” datasets later become identifiable when combined with other data. More fundamentally, the policy must make consent explicit when data moves from public service delivery to value creation.
Second, a transparent data valuation framework must account for both access and expected value
Existing approaches to pricing non-personal data lie on a spectrum. At one end is the practice Kenya’s own policy identifies as a failure: “unconsented web scraping, low-wage data annotation,” where value is extracted with no formal pricing process. At the other end is a centralized, fee-based licensing model like the UK’s Ordnance Survey, where a government body sets a fixed price for access.
Kenya’s draft policy points to the latter approach. It commits to delivering “benefits back to citizens” through a marketplace with clear licensing models, fair competition rules, and regulatory oversight for data intermediaries and brokers. However, it does not specify how prices are set, deferring standardized valuation methodologies to a later phase (see annex 3, policy objective 6.2).
Data valuation and compensation are thorny problems, and missteps risk concentrating economic benefit in a few commercial entities rather than the public. Kenya could draw on existing models: China’s data exchanges weigh “costs, expected income and historic prices” for price-setting, while proposals like DPI-DDM compensate individuals whose data is included. Prices could also be set dynamically through negotiation or bidding. Regardless of approach, the government should be fully transparent about how data is priced and how benefits flow to data subjects, if at all.
Third, greater clarity is needed to balance utility benefits against privacy risks
The Kenyan draft policy proposes to broker access to “anonymized, non-personal datasets”. However, the proposal acknowledges that “non-personal data lacks clear legal definition” under Kenyan law, and it remains unclear what data is in scope.
Anonymization is a notoriously weak form of data protection and can be combined with other data sources to infer data about private individuals, as seen in the infamous recovery of medical data about the governor of Massachusetts. Such risks could erode trust and expose the program to legal challenges on the grounds of data privacy violations, as illustrated by the recent suspension of the US-Kenyan Health Cooperation Framework. Indeed, Kenyan courts have shown a willingness to scrutinize and block projects that do not adequately consider data privacy since the rollout of the Data Protection Act in 2019.
It is also unclear whether these datasets will provide a recurring source of revenue. For instance, if they are used to train a public-facing generative AI model, new users may find it cheaper to simply query that model than purchase dataset access. Moreover, leading AI models are increasingly trained not on fixed datasets but on dynamic data streams and environments. Depending on the use case, static datasets risk not providing enough recurring revenue to justify the privacy risks.
The Kenyan government should therefore avoid the language of “anonymized, aggregated datasets” and instead broaden the scope of protections beyond anonymization. Technical tools like differential privacy and synthetic data can complement standard anonymization methods, mitigating privacy risks without necessarily sacrificing downstream performance. Likewise, use-case-driven monetization models based on data streams or interactive environments, for instance, could address the risk of limited-use datasets.
Kenya’s data strategy could become a model—or a cautionary tale
Recent geopolitical shocks, including the Iran war, have underscored a basic reality in the global economy: control over critical resources is control over one’s own destiny. Against this backdrop, the Kenyan government’s push to manage data as a national resource is a logical extension of the growing recognition that data has become a strategic resource.
But translating that ambition into reality will require careful execution, as poorly designed governance structures could not only weaken the program itself but also deter other governments from pursuing greater control over their own national data.
By prioritizing transparency, accountability, and strong privacy protections, Kenya can position itself as a model for how countries manage data—and increase its chances of shaping data management practices nationally and globally.
Giulia Fanti is a nonresident senior fellow at the Atlantic Council’s GeoEconomics Center and the Angel Jordan associate professor of electrical and computer engineering at Carnegie Mellon University.
Karen Sowon is an assistant professor of public and environmental affairs at Indiana University Bloomington.
Aadyaa Maddi is a PhD candidate at Carnegie Mellon University.
At the intersection of economics, finance, and foreign policy, the GeoEconomics Center is a translation hub with the goal of helping shape a better global economic future.
Further reading
Mon, Mar 10, 2025
Emerging technology policies and democracy in Africa: South Africa, Kenya, Nigeria, Ghana, and Zambia in focus
Report By
How are African nations navigating the governance of AI, digital infrastructure, and emerging technologies? Emerging Technology Policies and Democracy in Africa: South Africa, Kenya, Nigeria, Ghana, and Zambia in Focus examines how five key countries are shaping regulatory frameworks to drive innovation, protect digital rights, and bridge policy gaps in an evolving tech landscape.
Mon, Aug 12, 2024
Tech regulation requires balancing security, privacy, and usability
Econographics By
Good policy intentions can lead to unintended consequences when usability, privacy, and security are not balanced—policymakers must think like product designers to avoid these challenges.
Mon, Nov 15, 2021
Data rules for machine learning: How Europe can unlock the potential while mitigating the risks
Report By
Artificial intelligence (AI) will increasingly shape societies and the global economy. Machine learning—which is responsible for the vast majority of AI advancements—is enhancing the way businesses and governments make decisions, develop products, and deliver services. How will the European Union unlock the potential of AI, while mitigating the risks?
Image: Christmas and rush-hour traffic on Ronald Ngala Street in Nairobi, Kenya. Source: iStock.