Every time you log into a work platform, complete a task, accept a trip, upload a selfie, submit an annotation or communicate with support, information may be collected or generated about you.
This information can affect your access to work, earnings, performance ratings, task allocation, account restrictions and deactivation.
You are not only a worker within a digital system. You are also a data subject with rights.
Work, ratings & automated management
Selfies, location, keystrokes & audio
Kenya DPA 2019 & International protections
Workers in Kenya have rights over personal information held or used by companies, platforms and other organisations.
Understand how and why your personal data is being collected and used.
Ask an organisation to confirm whether it holds your personal data and request access to it.
Object to certain uses of your personal information.
Ask for false, incomplete or misleading information to be corrected.
Request deletion of false or misleading personal data where the law allows.
Section 26 of the Kenya Data Protection Act, 2019 recognises the rights to be informed, access personal data, object to processing, request correction and request deletion of false or misleading data. Where the GDPR applies, related rights include access, rectification, erasure in qualifying circumstances, restriction, objection, portability and protections concerning certain automated decisions.
The GDPR does not automatically apply to every worker or company in Kenya. Its application depends on the organisation, its location and the nature of the data processing.
A Subject Access Request, commonly called a SAR, is a request asking an organisation to:
Under Kenyan regulations, this may also be described as a data access request.
A Subject Access Request is a practical way to understand what information a platform or company holds about you.
A detailed worker-friendly guide is being developed.
Platform workers encounter various situations where requesting personal data is crucial to protecting livelihoods and ensuring accountability.
You want to understand whether ratings, complaints, account flags, performance records or automated systems contributed to the decision.
This could include inaccurate identity information, ratings, location records, quality scores or performance assessments.
This may include identity documents, facial scans, iris scans, voice recordings, fingerprints or photographs of you, your home or your family.
You want to understand whether information collected for one purpose is being used for another.
You want to identify the companies, clients, contractors or service providers that have received your data.
You want information about the data and main factors used to allocate work, calculate performance, restrict an account or make another significant decision.
Section 35 of the Kenya Data Protection Act and Article 22 of the GDPR provide protections relating to certain decisions based solely on automated processing that significantly affect an individual.
The information available will depend on the platform and the personal data it holds.
Important Scope Boundary: The right of access concerns your personal data. It does not automatically provide access to every company document, another person’s information, confidential business information or a platform’s complete source code.
DSA is developing step-by-step guides showing workers how to submit data-access requests to the specific platforms and companies they work through.
Find the organisation holding or using your data. Check its privacy notice, help centre, privacy team or Data Protection Officer contact.
You may request all personal data held about you or focus on a particular account, project, decision, incident or period.
Use the organisation’s privacy portal, in-app privacy centre, online request form, privacy email address or Data Protection Officer.
Save the request, submission date, screenshots, confirmation emails, reference numbers and responses.
Check whether the organisation answered your questions, supplied the requested data and explained anything it refused or withheld.
Different forms of digital work generate different types of personal data. Select your sector to see some of the issues that may affect you.
Personal data should be processed lawfully, fairly and transparently, collected for clear purposes and limited to what is necessary.
These principles appear in Section 25 of the Kenya Data Protection Act and Article 5 of the GDPR.
We are developing accessible resources that workers can use independently or with support from DSA.
How to prepare, submit, record and follow up on a request.
A downloadable template workers can adapt when requesting their personal data.
Instructions for ride-hailing, delivery, content-moderation and data-annotation platforms.
What to do when a company does not respond or provides an incomplete answer.
Workers who believe their data-protection rights have been infringed may submit a complaint to Kenya’s Office of the Data Protection Commissioner.
DSA supports workers to identify the correct organisation, prepare a clear data-access request, decide which information to request, keep records, understand the response and identify appropriate follow-up or complaint options.
"Our role is to help workers exercise their data rights with greater knowledge, confidence and collective power."
The information on this page is provided for general education and worker-support purposes. It is not legal advice and does not guarantee the outcome of a request or complaint.
The law that applies may depend on the worker’s location, the organisation involved, where the data is processed and the particular circumstances of the case.