The Watched Workplace: CCTV, Biometrics and Employee Data Under Kenyan Law

In brief

• The Kenyan workplace is now thoroughly observed, cameras in the corridors, fingerprints at the door, software on the laptops and trackers on the vehicles, and every one of those observations is the processing of personal data under the Data Protection Act, 2019, with an employer answerable for it.
• Consent, the basis most employers reach for first, is the weakest basis available in employment, because consent given to the person who pays your salary is rarely free. The lawful workplace runs on better foundations, and on notice, proportionality and restraint.
• For the employee, the Act is a set of rights that survive the employment and outlive the dismissal. For the employer, it is a compliance exposure with a regulator attached, and the complaint is free to file.

Walk through any serious Nairobi workplace and count the ways it watches you. The camera above the till and the one in the corridor. The fingerprint reader that clocks you in. The badge that logs every door. The software that knows which websites the laptop visited, and the tracker that knows where the delivery motorcycle stopped and for how long. None of this is sinister in itself, and most of it exists for honest reasons, security, safety, payroll accuracy, the protection of stock. But every frame, scan and ping is personal data about an identifiable employee, and the Data Protection Act, 2019 does not pause at the office door. This guide is for both people in that building, the employer who installed the systems and must now operate them lawfully, and the employee under their gaze who wants to know where the line sits.

The starting point: employees are data subjects, employers are controllers

The Act draws no distinction between the customer whose data a business guards jealously and the employee whose data it handles carelessly, and in practice the second file is almost always the bigger one. An employer holds identity documents, next of kin, bank details, medical certificates, disciplinary records, performance reviews and, increasingly, images and biometrics, and in holding them it is a data controller with the full catalogue of obligations: processing on a lawful basis, for a stated purpose, no more data than the purpose needs, kept accurate, kept secure, kept no longer than necessary, and disclosed to the employee on request. Most employers of any size are also required to be registered with the Office of the Data Protection Commissioner, and an employer running surveillance systems should check its registration position before the regulator checks it instead.

Why consent is the wrong foundation, and what the right ones are

The instinct of every HR department is to solve data protection with a signature, a consent clause in the contract and a form at onboarding. The instinct is understandable and mostly wrong. Consent under the Act must be free, and the law has long recognised that consent given to the person who controls your livelihood is suspect, because an employee who cannot realistically say no has not meaningfully said yes. A consent that cannot be refused, or cannot be withdrawn without consequence, will not carry weight when tested. The sturdier foundations are the ones the Act itself offers: processing necessary for the performance of the employment contract, which covers payroll and administration; compliance with legal obligations, which covers the statutory deductions and records this series has already walked through; and the employer’s legitimate interests, which, properly assessed and documented, carry most security and monitoring uses, provided the interest is real, the means proportionate, and the employee told. Notice, not consent, is the working currency of lawful workplace monitoring, and the employer who relies on a signed consent for its cameras has built on the weakest ground available.

CCTV, lawful when it is honest

Cameras are lawful in the Kenyan workplace, and they are lawful on conditions that amount to honesty. The employee and the visitor should know the cameras are there, which is what signage and the staff policy are for, and covert surveillance should be treated as the rare exception it is, reserved for the investigation of specific serious wrongdoing and taken under advice, not run as a standing practice. The cameras should watch what the stated purpose needs, entrances, tills, stores, server rooms, and never the spaces where privacy is at its height, washrooms and changing areas being the obvious and absolute examples. The footage should be kept securely, seen by the few who need it, retained for a defined period and then gone, because a year of corridor footage on an unsecured hard disk is not security, it is a breach waiting for its occasion. An employer who can say where its cameras point, why, who views the footage and when it is deleted has substantially complied; an employer who cannot answer those four questions has a project for this month.

Biometrics, the highest grade of data at the front door

The fingerprint reader deserves more respect than it gets, because biometric data is sensitive personal data under the Act, the category the law guards most tightly, sitting alongside health and similar information. A business that would never dream of casually handling employees’ medical files is often handling their fingerprints through a vendor it has never questioned, under a contract it has never read. The lawful deployment is deliberate: a written assessment before the system goes in, asking whether the purpose, usually time and attendance, genuinely needs biometrics or would be served by cards or codes; a hard look at the vendor, where the templates are stored, in what form, and under what contract, because the employer remains answerable for its processor; a genuine alternative for the employee who objects, which is both good practice and the proof that the arrangement was never coerced; and deletion when the employment ends, since there is no purpose that justifies holding the fingerprints of people who left two years ago. The same discipline applies to the newer arrivals, facial recognition at the gate and GPS trackers on vehicles, where the monitoring of the asset shades into the monitoring of the person riding it, and the proportionality question must be asked about the person, not the motorcycle.

Email, laptops and the limits of looking

The work systems belong to the employer, and the employer may monitor them, but ownership of the laptop is not ownership of the life lived through it, and the monitoring must still pass through the Act. The lawful position is built on a policy that tells employees plainly what is monitored and why, applied consistently rather than aimed at individuals, proportionate to a stated purpose, and restrained where the expectation of privacy is highest, in personal communications that inevitably pass through work devices. Reading a departing employee’s mailbox for evidence is the commonest flashpoint, and the employer who does it without a policy, a purpose and a record should expect the evidence to be attacked and the search itself to become a complaint. Here as everywhere in this field, the paper you prepared before the dispute is worth ten of the explanations you compose after it.

The employee’s rights, which outlive the job

Every employee, current or former, may ask what data the employer holds, obtain a copy, demand correction of what is wrong, and object to processing that oversteps, and these rights have acquired a sharp practical edge, because the data subject access request has become the opening move of employment litigation. The dismissed employee who requests their complete file, the CCTV footage of the incident and the access logs is exercising rights the Act gives them, on timelines the regulations set, and the employer’s response is itself evidence of its compliance culture. Where the rights are refused or ignored, the complaint goes to the Office of the Data Protection Commissioner, it costs nothing to file, and the Commissioner has shown no reluctance to investigate employers, order compliance and impose penalties. The exposure is concrete: administrative fines of up to five million shillings or one percent of annual turnover, whichever is lower, per infringement, compensation claims by the affected employees riding alongside, and a public determination with the employer’s name on it, which for many businesses costs more than the fine.

What happens next

This article closes the opening run of the Work Matters series, which has moved from the payslip to the contract, the dismissal, the redundancy and now the watched workplace, and the series continues with the disputes and reforms as they come. For the employer, the five articles together describe a single discipline, the employment relationship run on documents prepared before they are needed. For the employee, they describe a single truth, that the law gives you more than most workplaces tell you. Both are reasons to take advice early rather than consolation late.

Frequently asked questions

Can my employer record me on CCTV without telling me?

Open surveillance with notice is lawful when proportionate to a real purpose such as security. Covert recording is the narrow exception, confined to the investigation of specific serious wrongdoing and best taken under advice, and cameras in washrooms or changing areas are indefensible in every circumstance.

Is fingerprint clock-in legal in Kenya?

It can be, but biometric data is sensitive personal data under the Act, so the employer needs a documented assessment, a trustworthy vendor arrangement, an alternative for employees who object, and deletion when employment ends. A reader bought online and plugged in is not a compliance position.

Can my employer read my work email?

Work systems may be monitored under a clear policy, consistently applied and proportionate to a stated purpose. Targeted reading of an individual’s mailbox without policy, purpose or record is where lawful monitoring ends and complaints begin.

What can I do if my employer misuses my data?

Raise it internally in writing first, then complain to the Office of the Data Protection Commissioner, which costs nothing. You may also claim compensation for damage suffered, and your rights of access, correction and objection continue after the employment ends.

What does non-compliance cost an employer?

Administrative fines of up to five million shillings or one percent of annual turnover, whichever is lower, for each infringement, alongside compensation claims and a published determination. The reputational entry is usually the expensive one.

Peter Maina is a Partner of Peter Maina & Company Advocates. This article states the law as at 15 October 2026. It is general information, not legal advice. For workplace data protection audits, policies and ODPC matters, on either side, reach out on e-mail peter@pmlaw.co.ke or WhatsApp +254 714 644 080.