Ordinary Kenyans are increasingly questioning how political parties and politicians obtain their private telephone numbers after receiving targeted SMS and WhatsApp messages seeking to influence their political choices ahead of the 2027 General Election.
For some recipients, the messages appear surprisingly personalised, prompting concerns about where political actors obtain the data they use to reach potential voters.
For many, the question is simple: “How did they get my number?”
The messages range from invitations to political meetings and campaign events to appeals for support and information about particular candidates.
Others are circulated through WhatsApp groups or sent directly to individuals from numbers they do not recognise.
The growing use of mobile phones and social media has provided politicians with a powerful way of reaching voters directly.
But as political mobilisation becomes increasingly data-driven, questions are emerging over whether Kenyans have knowingly consented to their personal information being used for political communication.
For recipients, the concern goes beyond receiving unwanted messages. Some want political parties and campaign teams to explain where their telephone numbers came from, who authorised their use and whether information collected for other purposes is being shared with political organisations.
The concerns have brought Kenya’s data protection framework into sharper focus as political parties and campaign teams increasingly rely on databases, digital platforms and targeted communication to identify and reach voters.
Under the Data Protection Act, personal data must be processed on a lawful basis and for a specific, legitimate purpose.
The law provides safeguards for information such as telephone numbers and other personal identifiers, while offering additional protection to sensitive personal data, including information relating to a person's health, ethnic origin and religious beliefs.
Organisations processing personal information are also required to observe transparency and other obligations governing how data is collected, used, stored and shared.
Data Commissioner Immaculate Kassait said every election cycle involves Kenyans handing over significant amounts of personal information alongside their vote, including names, addresses, national identification card numbers and fingerprints.
She said the information moves through various actors involved in the electoral process, including the electoral agency, political parties, observers and campaign volunteers.
“Until recently, most Kenyans had little idea where that information went, who used it, or how to stop it being misused,” Kassait said.
She said the Office of the Data Protection Commissioner has issued guidance for several sectors, including the electoral process, placing Kenya’s election machinery firmly within the framework of the Data Protection Act, 2019.
“The rules apply to every organisation touching voter data, from the IEBC to small civil society groups helping with voter registration,” she said.
Kassait said organisations cannot simply collect or process personal information because they want to do so, noting that the law requires a lawful basis for processing personal data.
For the Independent Electoral and Boundaries Commission, some processing is anchored in electoral law and its statutory mandate.
Maintaining the voter register, for example, is part of the commission’s legal responsibilities and does not depend solely on individual consent.
Political parties have different obligations depending on the circumstances in which they obtain and process personal information.
Where consent is the lawful basis for collecting data, Kassait said it must be freely given, specific and informed.
She said transparency was central to the protection of personal information, with organisations expected to tell individuals what data is being collected, why it is being collected, who may receive it and what rights the individual has.
This has particular significance as political parties expand their digital campaigns and seek to build databases of supporters, members and potential voters ahead of the 2027 election.
Kenyans retain rights over their personal information even after it has been collected, including the right to seek access to information held about them and request correction of inaccurate data. In circumstances provided for under the law, individuals may also object to certain forms of processing.
The growing concern over unsolicited political messages could therefore become an important test of how political parties and campaign organisations handle personal data as the 2027 election approaches.
For voters receiving messages from politicians they have never contacted or supported, the issue is not simply whether they want the messages.
It is also about who gave their number to the sender, why it was obtained and whether it is being used lawfully.
