CYBER SECURITY MEASURES AND PROTECTION OF PERSONAL DATA IN PUBLIC SECTOR INSTITUTIONS IN KENYA
Main Article Content
Abstract
In Kenya, government agencies face growing cyber-attack complexity as they quickly adopt digital systems for service delivery. Handling large amounts of sensitive data, such as biometric, financial, health, and identity info, increases their vulnerability. Kenya has enacted laws and policies like the Data Protection Act (2019) and the National Cyber security Strategy. Yet, government organizations find it hard to implement them. This paper reviews current cyber security practices in Kenyan public sector bodies. It evaluates the performance of government policies and laws. It also synthesizes recent research to find out how public institutions protect personal data. Based on existing policy papers, legal documents, institutional reports, and research papers, this study finds a gap between policy goals and actual practice. Despite relevant regulations, cyber security measures and their enforcement are underdeveloped and inconsistent, causing vulnerabilities and raising the risk of data breaches. The study suggests improvements to management and institutions to help grow cyber security and data protection in Kenya's public sector.
Article Details
References
Government of Kenya. (2021). National Cybersecurity Strategy 2021–2025. Nairobi: Ministry of ICT.
Jonyo, F., & Philip, K. (2024). Public–private partnerships and cyber security governance in Kenya. National Security Journal, 7(1), 45–62.
Kinyua, C. G. (2024). Cybersecurity risks in Kenyan government institutions. Journal of Environmental Sustainability Advancement Research, 3(2), 88–102.
Linturi, T., & William, C. N. (2024). Adaptive cyber resilience policies in public sector institutions. National Security Journal, 7(2), 63–79.
Mathenge, R., & Karani, J. (2024). Legal frameworks for digital space protection in Kenya. International Journal of Computer and Information Technology, 13(4), 112–125.
Alshaikh, M. (2021). Developing cybersecurity culture to influence employee behavior: A practice perspective. Computers & Security, 98, 102003.
Bada, M., Nurse, J. R. C., & Sasse, M. A. (2020). Cyber security awareness campaigns: Why do they fail to change behaviour? Information & Computer Security, 28(1), 71–85.
ENISA. (2023). Cybersecurity governance guidelines for public administrations. European Union Agency for Cybersecurity.
Kaifa, U., Yaseen, D. Z., & Muzaffar, D. M. (2025). A thematic analysis of cybersecurity policies, regulations and implications. Journal of Climate and Community Development, 4(1), 39–54.
Ogutu, K. O., Obosi, J. O., & Odongo, H. A. (2025). Cybersecurity training and institutional capacity in Kenya. Journal of Public Policy and Administration, 9(1), 21–38.
Saidi, I. C., Kimuyu, J. J., & Handa, S. (2024). Cybercrime and economic security in Kenya. International Journal of Research and Innovation in Social Science, 8(3), 134–149.
Sema, G. G., Owolawi, P. A., & Olugbara, O. O. (2025). Data protection law implementation in African public institutions. Sustainability, 17(2), 1–15.