The Private Hands Behind Kenya’s Billion-Shilling Digital Systems

Kenya’s digital public service systems remain under the control of private contractors, raising legal and governance concerns over data sovereignty, transparency, and compliance with national laws.

Kenya’s rapid shift to digital service delivery is facing scrutiny as several critical platforms, including e-Citizen, the Electronic Government Payment System (e-GPS), the National Transport and Safety Authority (NTSA) system, and the Social Health Authority’s health information system, are either partially or fully operated by private firms. 

Some of these companies are based outside the country, with reports indicating that even the Independent Electoral and Boundaries Commission (IEBC) servers are hosted abroad. Auditor-General Nancy Gathungu and legal experts have raised concerns about the security and oversight of sensitive infrastructure managed by third parties. 

Former Attorney-General Justin Muturi said that the arrangement may violate the Data Protection Act, suggesting that private financial interests could be influencing key decisions. The e-Citizen portal, which integrates over 20,000 services from more than 100 government agencies, illustrates the scale of the digital transformation. 

However, questions remain over the ownership and control of its core systems. Treasury Cabinet Secretary John Mbadi confirmed that the e-GPS platform, procured in 2022 for Sh375 million, is still under development and has not yet been fully transferred to government ownership. The system is being developed by Indian firm i-Sourcing Technologies in partnership with Kenyan company Sybyl, under a contract now extended to 2028.

Mbadi stated that the government will eventually gain full access and control of the system, but the transitional period has raised concerns about accountability and the government’s readiness to manage the platforms independently. Kitutu Chache South MP Anthony Kibagendi has announced plans to seek a special audit of the NTSA system through Parliament.

In the health sector, a Sh104.8 billion contract for the development of the Integrated Healthcare Information Technology System (Ihits) has also drawn attention. The system is a key component of President William Ruto’s Universal Health Coverage (UHC) programme and is being developed by a consortium led by UAE-based Apeiro Ltd, with support from Safaricom and Konvergenz Network Solutions. 

Apeiro holds a majority stake and has established a local subsidiary for the project, which is set to run for 12 years. Some lawmakers have raised concerns about the involvement of foreign companies in managing sensitive health data. They have also questioned the procurement process, with former Health Committee Chair Dr James Nyikal noting that other potential providers were not invited to bid. 

This follows a similar case in 2017, when a contract with Seven Seas Technologies for a similar system was terminated over contractual issues. Health Cabinet Secretary Aden Duale has defended the contract, stating that all health data is stored on a sovereign cloud within Kenya and that the Ministry complies with the Data Protection and Digital Health Acts. He added that the system uses a Zero Trust security model and end-to-end encryption to protect data.

Data Protection Commissioner Immaculate Kassait clarified that while outsourcing is permitted, it must comply with legal safeguards, including data localisation and the requirement to report any data breaches within 72 hours. However, effective enforcement of these rules depends on institutional capacity and political will.