Kenyans registering new SIM cards may soon be required to provide highly sensitive personal information, including DNA, blood type, and detailed biometric markers, under the Communications Authority of Kenya’s (CA) proposed 2025 regulations, which also obligate mobile operators to maintain comprehensive subscriber databases and submit them quarterly to the regulator.

Critics warn that these requirements conflict with the Data Protection Act’s principles of data minimisation, raising privacy concerns and placing service providers in a difficult position between the cost of compliance and maintaining subscriber trust.