-Ad-

Insights At a Glance:

A website called Data Kenya Shop is openly selling detailed personal data of Kenyans — including names, phone numbers, ID/passport numbers, counties, wards, and polling stations.
The site claims all data is publicly available, but sample datasets show extremely specific info that raises serious data privacy concerns.
Despite Kenya’s data protection laws, such platforms remain active, highlighting a major gap in enforcement and digital accountability.

A few days ago, I stumbled on something… troubling. And if you’re Kenyan, or just happen to own a Kenyan phone number, this might concern you too.

It started innocently enough. I received a WhatsApp message confirming an order I had placed — or rather, a sample dataset I had purchased from a website called Data Kenya Shop. I had only spent KES 50, just to see what kind of information this site actually sells. The screenshot below is proof of the message they sent me:

This was my digital rabbit hole.

The Big Discovery

So, what is Data Kenya Shop? On the surface, it’s a clean, professional-looking site that markets itself as a resource for “pre-verified contact databases and email lists” for marketers and businesses. It even proudly states on its homepage:

-Ad-

Buy Verified Contact Databases and Email List

Get instant access to high-quality, pre-verified contact databases and targeted email lists for marketing, outreach, and lead generation. Reach real people, boost conversions, and grow your business faster.

Sounds like your average lead generation tool, right?

But dig deeper — and the rabbit hole gets darker.

What’s Actually Being Sold?

Once you’re inside, there are two major product categories:

Software & Business Databases
- Plugins for WordPress and WooCommerce (e.g. M-PESA integrations, SMS, WhatsApp APIs)
- Massive datasets for entire industries like:
  - 2025 Airtel Kenya Database (KES 45,500)
  - 2025 Kenya Gamblers Database (KES 105,000)
  - 2025 Lawyers LSK Database (KES 45,000)
  - 2025 Schools Heads & Principals (KES 45,000)
  - And yes — a 2025 NTSA Database (KES 110,000)
Geo-based Databases – Every county in Kenya is listed. Every sub-county. Every ward. Want phone numbers of people in Westlands Ward? That’s KES 2,500. From Vihiga County? Still KES 2,500. This level of granularity screams targeted political or commercial messaging.

The Experiment: KES 50 Sample

I wasn’t willing to shell out thousands just to investigate. Luckily, the site offers sample datasets at KES 50 or 100. You don’t even get to choose which sample — they send you whatever they pick.

I received an Excel file that includes:

Full names (First, Middle, Surname)
ID or Passport numbers
Phone numbers
County, Constituency, Ward and codes
Polling station names and codes

(They redacted the year of birth, but everything else was intact.)

Now here’s where it gets worrying. I picked a few numbers from the file, keyed them into the MySafaricom app, and attempted to make an M-PESA transaction just so that I can verify the info. To my surprise, the names matched. Perfectly. That means this isn’t just scraped spam. This is authentic data — real Kenyans with real phone numbers tied to real names and IDs.

Let that sink in.

Where Is This Data Coming From?

The site claims:

We do not sell private or personally identifiable data... All data is collected exclusively from publicly accessible online sources…

Sounds neat and clean. Until you remember that ID numbers, passport numbers, and phone numbers are supposed to be private information. So where’s it from?

Voter registers?
Leaked mobile operator data?
Government service databases like NTSA or Huduma?
Political party memberships or campaign teams?

Your guess is as good as mine — but the fact that I, a random internet user, could buy this data in a few clicks via MPESA is terrifying.

But… Is It Legal?

That’s the greyest area.

What the site says:

They don’t store “sensitive or process personal data” as defined by GDPR and only aggregate public info. They ask users to ensure they comply with local data laws.

What Kenya says:

Kenya’s Data Protection Act (2019) prohibits the collection, processing, or selling of personal data without consent. Personal data includes names, IDs, contact info, and more. The Office of the Data Protection Commissioner (ODPC) has actively warned against unauthorized data use — and even shut down Worldcoin’s operations temporarily due to such violations.

What reality says:

If a random site is offering the name, ID, polling station, and phone number of your grandmother in Makueni for KES 2,500… that feels illegal, even if their lawyers wrote 10,000 words saying otherwise.

Think about it:

Have you ever received SMSs during election season from random candidates who somehow knew your name and ward?
Have you wondered how those pesky insurance agents got your phone number and email?
Have you applied for something with your phone number, only to get weird “Congratulations! You’ve won…” texts days later?

Well, this is how.

Platforms like Data Kenya Shop, whether knowingly or not, are commoditizing your identity. And there’s a whole economy of marketers, politicians, and even scammers who are willing to pay for it.

Kenya is sprinting toward a digital future. We’re already dealing with KRA-linked device registrations, surveillance debates, biometric laws, and ongoing court cases on digital privacy.

But none of it matters if our most basic personal data is still for sale.

It’s not enough for telcos, government bodies, and digital platforms to promise us privacy. We need actual enforcement, transparency, and accountability. And as consumers? We must demand answers. Who gave out your number? Your ID? Your polling station? You have a right to know.