Before an international passenger reaches Jomo Kenyatta International Airport, information about the traveller and the journey may already have moved from an airline system to Kenya's Directorate of Immigration Services. The existence of that route is public. The accountability question is how responsibility is divided at every point along it.
The Directorate says that, from 21 May 2025, carriers and general aviation operators must transmit Advance Passenger Information and Passenger Name Record data through the designated provider, SITA. That statement identifies the sender, the transmission provider and the receiving public authority. It does not mean the three actors have the same legal role.
The airline holds the first operational record ¶
The airline creates or receives booking and check in information. It is responsible for the accuracy of the details entered into its systems and for transmitting the fields required by the Kenyan framework. A passenger correcting a misspelled name or passport number will ordinarily begin with the airline.
The Directorate of Immigration Services receives the required data to perform border management functions under Kenyan law. It determines the public purpose for which that information is used and remains responsible for public decisions.
SITA is named as the designated provider through which carriers transmit the data. A transmission or processing provider can operate infrastructure without becoming the immigration authority. Its access and use should be limited by the contract, the law and documented instructions.
Controller and processor labels must reflect reality ¶
The Office of the Data Protection Commissioner's transport sector guidance says public and private transport organisations may act as data controllers or processors. The label depends on who decides the purpose and means of processing, not merely on who owns a server or signs a service contract.
A public data map should therefore identify the controller for each stage, every processor acting on its instructions, approved user groups, data locations, cross border transfers, retention periods and deletion rules. If responsibility changes between the booking, transmission, border assessment and archival stages, the map should show that change.
API and PNR should not be treated as one vague file ¶
API normally contains structured identity and flight details such as name, date of birth, nationality, travel document information, flight number and route. PNR is the reservation record and can reflect how a journey was booked or changed.
The difference matters for necessity and retention. A field needed to confirm identity may have a different value and risk from a reservation detail. Treating every field as part of one undefined passenger data pool makes it harder to explain why it is collected and how long it should remain available.
The public can be informed without exposing security rules ¶
Government should not publish watchlists, risk thresholds, security architecture or access credentials. It can still publish a privacy notice that answers ordinary questions:
- What categories of API and PNR data are required?
- What law and specific purposes authorise the processing?
- Which institution is the controller at each stage?
- Which providers process data under instruction?
- Which broad user groups may access the information and how is access logged?
- How long is each category retained?
- How can a traveller seek access, correction or redress?
- What safeguards govern transfers outside Kenya?
These disclosures explain governance, not operational tactics.
Independent checks should test the controls ¶
Policy statements are only the first layer. A mature system should be able to show that access logs are reviewed, user permissions are removed when staff roles change, security incidents are recorded, retention rules are enforced and processors are audited against their obligations.
The Office of the Data Protection Commissioner can investigate complaints and enforce the Data Protection Act. Internal data protection officers, public audit institutions and parliamentary committees may also examine aspects within their mandates. The right review body depends on whether the issue concerns lawful processing, contract performance, cybersecurity, expenditure or an individual border decision.
The accountability map is the missing public instrument ¶
Kenya's border management portal explains the carrier onboarding route and names the designated provider. The ODPC has published detailed sector guidance. Joining those records in one current, system specific public notice would remove much of the uncertainty surrounding the data journey.
The strongest assurance is not a claim that data is safe. It is a clear responsibility map backed by access records, retention controls, incident procedures and independent review. That is the standard by which any public passenger data system should be judged, regardless of which technology supplier provides part of the infrastructure.
