Digital identity in Kenya.

The building blocks

A person's identity in Kenya is recorded in several connected systems, each with its own law and purpose:

• Birth registration, under the Births and Deaths Registration Act, records a person's existence from the start of life.
• The national identity card, issued under the Registration of Persons Act to Kenyan citizens from the age of 18, is the main proof of identity for adults, and its number is used across government and private services.
• The national population register, run by the State Department for Immigration and Citizen Services, brings together data from government registration agencies so that a person's identity details can be confirmed from an authoritative source. It was long known as the Integrated Population Registration System (IPRS) and is now the Maisha Integrated Population Register, managed by the Directorate of National Population Data Management.
• Passports, issued by the Directorate of Immigration Services (State Department for Immigration and Citizen Services), are used for travel and also as proof of identity.
• Identity documents for foreign nationals and refugees, issued under the Kenya Citizenship and Immigration Act, 2011 and the Refugees Act, 2021, identify people who live in Kenya but are not citizens.
• The KRA personal identification number (PIN) identifies taxpayers.
• Registered mobile phone numbers: under the Kenya Information and Communications Act and its subscriber registration regulations (the current regulations were made in 2025), SIM cards must be registered to their users, which makes the phone number part of many people's everyday identity, especially for mobile money.

For a business checking customers, the national ID number and the registers behind it are usually the anchor. The rest of this course looks at how that system is changing, how businesses use it, and the duties that come with it.

From Huduma Namba to Maisha Namba

Kenya has spent several years moving towards a single digital identity system.

Huduma Namba. In 2019, the government began registering residents in the National Integrated Identity Management System (NIIMS), known to the public as Huduma Namba, collecting personal and biometric data to issue a single identification number. The programme was challenged in court.

• On 30 January 2020, in Nubian Rights Forum & 2 others v Attorney General & 6 others, the High Court allowed NIIMS to proceed only once an appropriate and comprehensive regulatory framework for its implementation, compliant with the Constitution, was in place. It also found that collecting DNA and GPS coordinates for identification was intrusive and unnecessary, and struck down the provisions that required it.
• On 14 October 2021, in a case brought by the Katiba Institute, the High Court quashed the decision to roll out Huduma Namba cards because the government had not carried out a data protection impact assessment under section 31 of the Data Protection Act, 2019 before processing.

Maisha Namba. From November 2023, under amended registration regulations, the government began piloting Maisha Namba, a unique personal identifier assigned at birth registration and kept for life, together with a chip-bearing identity card, the Maisha Card, and a national population register. In December 2023 the High Court temporarily halted the rollout on an application arguing that no data protection impact assessment had been done. The judge later set that order aside when the case moved to the court's constitutional division, and the rollout resumed during 2024. Further court challenges about its legal basis, public participation and inclusion have continued.

The lesson for any organisation, public or private, is clear: in Kenya, large-scale processing of identity and biometric data needs a sound legal basis and a proper impact assessment before it starts. Courts have stopped programmes that skipped these steps. Because this area is changing, check the current law and the latest court decisions before relying on any detail here.

Using identity data in customer checks

Regulated businesses in Kenya use the national identity system in several ways:

• Confirming details against an authoritative source. Public and private institutions authorised by the State Department for Immigration and Citizen Services can check an identity number and its details against the national population register, directly or through an authorised service provider, usually for a fee per query. A match shows that a real identity with those details exists; it does not, by itself, show that the person applying is that person.
• Checking the person, by comparing their face with the document or the registered photo, and checking that they are present, before relying on the identity.
• Using the registered phone number as a second factor, since SIM cards must be registered to their users.

Mobile money and banking often use tiered customer due diligence: an account with low limits can be opened on basic verification, and fuller checks unlock higher limits. The international standards allow simplified measures where lower risks have been identified through adequate risk analysis. Alongside mobile money, simpler account opening has been part of Kenya's rise in formal financial access, which reached 84.8% of adults in the 2024 FinAccess survey.

Remember the limits of each source:

• A registered phone number confirms who registered the SIM, not who holds the phone today. SIM-swap fraud exploits exactly this gap.
• A matching ID number can be used by an impostor who knows someone else's details.
• A genuine document can belong to someone else.

That is why checks are layered, and why the strongest are those that tie the identity to the living person in front of you.

Nobody shut out

Identity systems decide who can open a bank account, get a SIM card, receive a government payment or apply for a job. When someone cannot prove who they are, they can be shut out of all of these at once.

Groups that have faced difficulty obtaining identity documents in Kenya have included people in border counties, who for decades faced extra vetting (abolished by presidential proclamation in February 2025); communities whose citizenship was only recognised recently, such as the Makonde (2016), the Shona and Kenyans of Rwandan descent (2020) and the Pemba (registered in 2023); refugees and asylum seekers, and people who lack birth certificates or other supporting papers. People with disabilities, older people and people with worn fingerprints can also struggle with biometric capture.

Businesses cannot fix national registration, but they can avoid adding barriers of their own:

• Accept the range of documents the law allows, not only the most convenient one.
• Use tiered, risk-based checks, so that low-risk products need less evidence.
• Offer a human route when automated checks fail, instead of rejecting the person.
• Design for low-end phones and weak connections, and for people with limited reading or digital skills.
• Measure who fails your checks, and investigate if some groups fail more often than others.

The international anti-money laundering standards encourage this: the FATF has published guidance, most recently updated in 2025, on applying its standards in a way that supports financial inclusion, including through risk-based and simplified measures.

Protecting identity data

Identity data is valuable to fraudsters and deeply personal to the people it describes. Kenya's Data Protection Act, 2019, supervised by the Office of the Data Protection Commissioner (ODPC), sets the rules for handling it.

Key duties for any business that collects identity data include:

• Registration: data controllers and processors must register with the Data Commissioner. Small organisations (turnover below KSh 5 million and fewer than 10 employees) are exempt, but the exemption never applies to certain sectors, including financial services and telecommunications, which must register whatever their size.
• A lawful basis and clear notice: tell people what you collect, why, and who you share it with.
• Data minimisation: collect only what the check needs. Do not keep a copy of an ID card simply because it is easy.
• Sensitive personal data: biometric data is sensitive personal data under the Act, and carries stricter conditions.
• An impact assessment before processing that is likely to be high risk, which the Huduma Namba and Maisha Namba rulings showed courts will enforce.
• Security and breach notification: protect the data. Where a breach creates a real risk of harm, the data controller must notify the Data Commissioner without delay, within 72 hours of becoming aware of it (giving reasons if later), and tell the people affected in writing within a reasonably practical period. A data processor must tell the controller within 48 hours where practicable.
• Retention: keep identity data only as long as the law and the purpose require.

Trust is the point. People share identity data when they believe it will be used fairly and kept safe. Every business that handles it either builds that trust or wears it down.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.