Technical and Vocational Education and Training (TVET) institutions have been urged to strengthen data governance systems to safeguard personal and institutional information amid the rapid shift to digital government services.
The call was made during a data protection and governance workshop that brought together stakeholders from TVET institutions, the government, and the Office of the Data Protection Commissioner (ODPC) to discuss the secure handling, storage, and sharing of information.
Dr. Reuben Lang’at, a lecturer at the University of Kabianga in the Department of Mathematics, Actuarial and Physical Sciences, said the engagement marked the beginning of a structured process to establish clear protocols governing the movement of data between Boards of Governors, government, and institutions.
Lang’at said boards of governors play an important intermediary role by receiving information from the government and relaying institutional data through appropriate channels. He said stakeholders must clearly establish who is authorized to receive information, when it should be shared, and the specific purpose for sharing it.
He said compliance with the Data Protection Act, 2019, should not be viewed as a one-off exercise, noting that registration with the ODPC alone does not amount to full compliance.
Institutions are also required to conduct Data Protection Impact Assessments on their systems and develop formal policies governing the management of personal information.
Lang’at said participants were expected to become “data champions” who would return to their respective institutions and sensitise trainers, administrative staff, and students on data protection.
He also noted that a circular issued by Principal Secretary Esther Koimett requires TVET institutions to establish Data Governance Committees with defined membership and terms of reference.
Lang’at said data protection should be integrated into the everyday operations of institutions as the sector continues to embrace digitalization. He described data as both numerical and non-numerical information, including names, identification numbers, and telephone contacts.
He warned that exposure of personal information could facilitate fraud, impersonation, and unauthorized monitoring of individuals. He said digital devices and third-party software can also create risks if institutions do not understand who has access to information and how that access is controlled.
“We need to determine exactly what data we collect and why,” Lang’at said, emphasising the need for clear access controls, secure storage, controlled sharing and proper disposal of information once it is no longer required.
He further urged institutions to protect trainee records, examination information, human resource files, financial records, and administrative documents.
He cautioned staff against physical security lapses, including leaving confidential documents exposed on desks, saying information security should become part of professional conduct.
Shadrack Tonui, Chair of the Kenya Association of Technical Training Institutions (KATTI), called for closer coordination between TVET institutions, professional bodies, and the State Department in handling sensitive information. He raised concern over sensitive institutional documents, including staff records, ministry memoranda, and recruitment directives, reaching the public before official release.
Tonui also called for greater standardisation of training programmes to reduce costs and ensure that certificates earned by participants contribute towards Continuing Professional Development points. He urged closer coordination between KATTI and State Department marketing officers to support efforts to increase TVET enrollment.
Tonui said the shift from physical records to digital platforms had created new data protection challenges, particularly where institutions rely on outsourced systems.
He questioned the extent of access third-party service providers may have to sensitive information and urged institutions to establish safeguards covering student identification details, phone numbers, health records, financial information, and fee balances.
John Okowi of the Office of the Data Protection Commissioner reminded participants that the right to privacy is protected under Article 31 of the Constitution and that the Data Protection Act, 2019, provides the main legal framework for handling personal information.
He said the ODPC is responsible for registration, compliance audits, investigations, enforcement, and public awareness, urging TVET institutions to strengthen their systems as they continue with digital transformation.
By Fidel Ochieng and Humphrey Edwin
