Kenya Digital Rights Risk Atlas

Advocacy & Action Guide

The DRRS gives you evidence. This page gives you the legal tools to act on it - FOIA requests under Article 35 of the Constitution, complaints to the Office of the Data Protection Commissioner (ODPC), and practical steps that work inside Kenya's county government system.

Before you start: what you need

Do not walk into a county office empty-handed. Prepare these things before you leave your house:

  • A Revenue Stamp: Buy a standard revenue stamp from your nearest Postal Corporation of Kenya (Posta) branch. It usually costs between Ksh 100 and Ksh 200. Not all counties legally require it for an Access to Information (ATI) request, but having one prevents a difficult clerk from rejecting your letter for not looking "official."
  • Printed Copies: Print exactly 3 copies of your request. One original for the County Secretary, one copy for the county files, and one copy that you will take back home.
  • Introduction Letter: If you are requesting on behalf of a local group or CBO, carry a brief letter of introduction on your group's letterhead.
  • Airtime: Ensure you have enough phone credit for follow-up calls. County offices rarely call you back.
  • The County Secretary's Name: Your letter must be addressed to the specific County Secretary. To find the name, check the county website. If the site is down, call the county switchboard and ask, “Who is the current County Secretary?” If the switchboard is off, call the County Public Service Board.

Step-by-step submission process

Step 1: Go to the County Registry. Do not hand your letter to a random secretary or a security guard. Ask the front desk at the main county headquarters: “Where is the central registry?” or “Where is the County Secretary's registry?” All official letters must go through the registry to get an official reference number.

Step 2: What to say at the desk. Keep it simple. Hand them the letters and say: “I am submitting an Access to Information request for the County Secretary. Please stamp my copy.”

Step 3: Get your copy stamped. The clerk must stamp your personal copy with a “RECEIVED” stamp, date it, and sign it. Do not leave without this stamped copy. This is your only legal proof that the county government received your request.

Step 4: What if they refuse to stamp? Sometimes clerks refuse to stamp letters they think are “sensitive.” If this happens:

  • Politely remind them that receiving a letter is just acknowledging delivery, not approving the request.
  • If they still refuse, leave their copies on the desk.
  • On your own copy, write the date, the exact time, the office name, and the name of the clerk who refused to stamp it. This handwritten note is legally acceptable proof of attempted delivery.

What happens after submission (the timeline)

The Access to Information Act gives the government 21 days to respond to your request. Here is how you manage that time:

  • Day 1: Get your stamped copy. File it safely.
  • Day 7: Call the registry or the County Secretary's office. Say: “I submitted an Access to Information request on [Date]. The reference is [Your Name/Org]. I am calling to check which officer is handling it.”
  • Day 15: Send a polite reminder letter. Attach a photocopy of your original stamped request.
  • Day 22 (Deadline Missed): The county is now legally in default. Stop calling them.
  • Day 30 (Escalation): File a formal complaint with the Commission on Administrative Justice (CAJ), also known as the Ombudsman. It is completely free. Call their toll-free line at 0800 221 349 or email complain@ombudsman.go.ke. Attach a photo of your stamped letter. You can also visit their headquarters in Nairobi (West End Towers, Waiyaki Way) or regional offices in Mombasa, Kisumu, Eldoret, Isiolo, Garissa, and Nyahururu. You can also report at the CAJ desk inside major Huduma Centres.

Active FOIA Pilots

3 requests filed across 3 counties

1 Acknowledged2 Submitted
NairobiRef: NBI/CECM/ICT/2026/0417DRRS 62
CCTV Monitoring· Filed 2026-06-01·8 days pending
County Clerk confirmed receipt. Awaiting substantive response on CCTV procurement contracts.
AcknowledgedTemplate 2
KisumuDRRS 50
Health Data Systems· Filed 2026-06-03·6 days pending
Submitted to CECM ICT via registered post. No acknowledgment yet.
SubmittedTemplate 1
GarissaDRRS 50
Digital Identity· Filed 2026-06-05·4 days pending
Filed under Article 35 for biometric enrollment protocols in county health facilities.
SubmittedTemplate 1
To update request status, edit src/lib/foia-data.ts and deploy.

Template 1: County ICT Contracts & Digital Service Delivery

Request under Article 35, Constitution of Kenya §4 Access to Information Act (2016) - Target: County Secretary

Most county ICT spending goes through IFMIS. This request asks for records that are legally required to be public but rarely shared proactively.

To: The County Secretary
[County Government Name]
P.O. Box [xxxxx], [Town]

Copy: The County Attorney
Copy: The Director, ICT

RE: REQUEST FOR INFORMATION ON ICT CONTRACTS AND DIGITAL SERVICE
    DELIVERY SYSTEMS IN [COUNTY NAME]

Under Article 35 of the Constitution of Kenya and Section 4 of the
Access to Information Act (2016), I request the following records:

1. A register of all ICT contracts awarded by the county government
   since [year], including vendor names, contract values, and
   procurement method (open tender / direct procurement / restricted
   tendering).

2. The county's Data Protection Impact Assessment (DPIA) register,
   if one exists, as required under Section 31 of the Data Protection
   Act 2019 for any processing that presents high risk to data
   subjects.

3. The name and contact details of the county's designated Data
   Protection Officer, if appointed as required by Section 18(2) of
   the DPA.

4. Any inventory of CCTV cameras, biometric enrollment systems, or
   digital identification systems operated by the county government.

Please provide these records within 21 days as prescribed by law.
If the county does not hold some of these records, please confirm
that in writing.

Yours faithfully,
[Your Name / Organisation]
[Phone number for follow-up]
[Email]

Template 2: Internet Shutdown & Network Disruptions

Request under Article 35, Constitution of Kenya - Target: County Commissioner / Communications Authority of Kenya

Internet shutdowns in Kenya are ordered at the national level (National Security Council) but enforced locally. This request targets both the national and county chain of command. CC the Kenya National Commission on Human Rights (KNCHR).

To: The County Commissioner
[County Name]
Office of the President

Copy: The Director General
      Communications Authority of Kenya
      P.O. Box 14448-00800, Nairobi

Copy: Kenya National Commission on Human Rights
      P.O. Box 74359-00200, Nairobi

RE: REQUEST FOR INFORMATION ON INTERNET DISRUPTIONS IN [COUNTY NAME]

Under Article 35 of the Constitution of Kenya, I request the
following records regarding internet disruptions documented in
[County Name] during the period June 2024 to June 2026:

1. Copies of any directives from the National Security Council or
   the Interior Ministry directing telecommunications providers to
   suspend or throttle internet services in [County Name] or the
   surrounding region.

2. Records of any requests made by the County Security Committee
   (chaired by the County Commissioner) to the National Government
   regarding network management during periods of civil unrest in
   the county.

3. Information on any compensation or remedy provided to residents
   or businesses for prolonged loss of connectivity.

Yours faithfully,
[Your Name / Organisation]
[Phone number]
[Email]

Template 3: CCTV & Public Surveillance Contracts

Request under Article 35, Constitution of Kenya §5(1) Access to Information Act - Target: County Secretary / CECM Security

County governments spend millions on CCTV systems through the County Security budget. These contracts are rarely disclosed. Use this template to find out what your county is buying and from whom.

To: The County Secretary
[County Government Name]

Copy: The County Executive Committee Member for Security
Copy: The Director, Supply Chain Management

RE: REQUEST FOR INFORMATION ON CCTV AND SURVEILLANCE
    INFRASTRUCTURE IN [COUNTY NAME]

Under Article 35 of the Constitution of Kenya, I request disclosure
of the following information:

1. A list of all CCTV cameras owned or operated by the county
   government, including locations, installation dates, and annual
   maintenance costs.

2. Procurement documents (tender notices, evaluation reports, and
   signed contracts) for any surveillance technology contracts
   awarded since [year], including the Nairobi Metropolitan Services
   (NMS) handover if applicable.

3. Any data-sharing agreements between the county government and
   national security agencies regarding access to CCTV footage.

4. The county's policy or by-laws governing CCTV surveillance,
   data retention periods, and public notification of surveillance
   zones.

Yours faithfully,
[Your Name / Organisation]
[Phone number]
[Email]

Template 4: ODPC Complaint - County Data Controller

Complaint under Section 34, Data Protection Act 2019 - File via: odpc.go.ke/complaints

The ODPC is increasingly active. In 2024, the office issued fines and enforcement notices against several data controllers. A complaint against a county government carries weight because of the public interest angle. Submit online or deliver a physical copy to ODPC headquarters, Nairobi.

To: Office of the Data Protection Commissioner (ODPC)
P.O. Box 1041-00606, Nairobi
complaints@odpc.go.ke

RE: COMPLAINT UNDER SECTION 34 OF THE DATA PROTECTION ACT 2019
    AGAINST THE COUNTY GOVERNMENT OF [NAME]

I, [Your Full Name / Organisation], lodge the following complaint:

1. The County Government of [Name] is a data controller as defined
   under Section 3 of the DPA, processing personal data of county
   residents through CCTV, biometric enrollment, health databases,
   and/or e-government platforms.

2. To the best of my knowledge, the County Government has NOT
   registered as a data controller with the ODPC (verify at
   https://www.odpc.go.ke/register/), in violation of Section 18
   of the DPA and the Data Protection (General) Regulations 2021.

3. On [date], I submitted a formal FOIA request under Article 35
   regarding these systems as detailed in the attached documents.
   The county [did not respond / denied the request / provided
   incomplete information].

4. The County Government has not appointed a Data Protection
   Officer as required by Section 18(2) of the DPA, depriving
   residents of a statutory point of contact for data rights.

RELIEF SOUGHT:
- An investigation into the County Government's data processing
  activities
- An enforcement notice compelling registration as a data controller
  and appointment of a Data Protection Officer
- A suspension order for any processing found to be unlawful

Supporting documents attached:
 FOIA request with stamped proof of delivery
 Any response received (or evidence of non-response)
 Relevant sections of the DRRS county brief

Yours faithfully,
[Your Name / Organisation]
[Phone number]
[Email]
[Date]

Verified contacts for key counties

Mombasa County

County Secretary: CS Jeizan Faruk

Email: countysec@mombasa.go.ke / info@mombasa.go.ke

Phone: Call 1599 (Mombasa County Call Centre)

Mombasa has a dedicated Access to Information Officer - email m.bates@mombasa.go.ke.

Kisumu County

County Secretary: CPA/CS Hesbon Owuor Hongo

Email: info@kisumu.go.ke

Phone: 057 202 5366

Physical: Cabinet Affairs Office, City Hall Building.

Nakuru County

County Secretary: Samuel Mwaura - mwaura.samuel@nakuru.go.ke

Deputy CS: Newton Mwaura Kamau - mwaura.newton@nakuru.go.ke

Machakos County

County Secretary: Dr. Muya Ndambuki

Website: machakos.go.ke

Nairobi County

Address your letter to “The County Secretary, Nairobi City County Government.”

Physical: City Hall, City Square. Take your letter to the main registry at City Hall.

Website: nairobi.go.ke

Quick reference: who to call

County Secretary - chief accounting officer, legally responsible for FOIA compliance. Find their name on the county government website or call the county switchboard.

County Attorney - handles legal affairs. Copy them on every FOIA request.

ODPC - complaints@odpc.go.ke / +254-20-277-9000. Physical office: Westcom Point, Mahiga Mairu Avenue, Nairobi.

CAJ (Commission on Administrative Justice) - handles FOIA appeal if a county ignores or denies your request. Visit their offices at 2nd Floor, Briarcliffe Gardens, off Gitanga Road, Nairobi. Ask for the Access to Information desk.

Kenya National Commission on Human Rights (KNCHR) - takes complaints on surveillance and internet shutdowns. Head office: CVF Plaza, Lenana Road, Nairobi.