Sending Kenyan travellers' passport details abroad
What Kenya's Data Protection Act requires before a travel agency sends a traveller's passport details to a hotel or airline outside Kenya.
By Achekam · · 5 min read · For Travel businesses in Kenya
Launching soon. The Industry CRM add-on described in this article is launching soon. This article describes it as it will work at launch.
A family of four from Nakuru is booked on a week in Dubai. The hotel wants passport copies before check-in, the airline needs passport numbers for the booking, and the tour operator running the desert excursion asks for names and dates of birth. Within a day, the agency has sent the same family's passport details to three businesses in another country, usually as e-mail attachments.
Under Kenya's Data Protection Act, each of those sends is a transfer of personal data outside Kenya, and the Act sets conditions for it. This article explains who the agency is under the Act, what it may collect and keep, what a transfer abroad needs, when an impact assessment comes first, and how the Travel pack in Achekam's Industry CRM handles passport details. It is a guide to the Act as published on Kenya Law, not legal advice.
Who the agency is under the Act
Kenya's Office of the Data Protection Commissioner defines a data controller as a person or entity that collects personal data and determines how it will be used, and a data processor as an entity that processes data on behalf of a controller. It defines a data subject as any individual who can be identified, directly or indirectly, through an identifier or personal data.
When an agency collects a traveller's passport details to make a booking and decides who receives them, it is acting as a data controller, and the traveller is the data subject. Whether the hotel or airline abroad then acts on the agency's behalf, or as a controller in its own right, depends on the arrangement, and a lawyer can help you place each supplier.
Registration comes with the role. The Act, as published on Kenya Law, says no person may act as a data controller or data processor unless registered with the Data Commissioner, subject to thresholds for mandatory registration that the Data Commissioner sets. Check where your agency falls against those thresholds.
Collect what the booking needs, and keep it no longer
Section 25 of the Act sets out the principles of data protection. Among them, personal data must be collected for explicit, specified and legitimate purposes, limited to what is necessary, kept accurate, and kept no longer than necessary.
For a travel booking, that translates into practical questions:
- What does this supplier actually need? An airline needs passport details for the passenger record; an excursion operator may need only names and ages.
- Do you need a full passport copy, or will the number, nationality and expiry date do?
- How long will you keep it? Once the trip is over and any follow-up is closed, the passport copy may no longer be needed for that booking.
- Is it accurate? A renewed passport makes an old copy wrong, and sending the wrong one can cause problems at the border.
The Kenya Law text of the Data Protection Act, 2019 sets out these principles in full, along with data subjects' rights and the Data Commissioner's powers, and it is worth reading the principles section in the original.
Sending details outside Kenya
The same section of the Act says personal data must not be transferred outside Kenya without proof of adequate safeguards or the data subject's consent. Every hotel, airline and ground operator abroad is a transfer destination.
In practice, an agency can work on both limbs:
- Consent. Ask the traveller, in writing and before you send anything, to agree that their passport details may be shared with the named suppliers abroad for the purpose of the trip. Make the consent specific to the booking rather than a blanket clause.
- Safeguards. For suppliers you use often, keep evidence of what each does to protect the data it receives, so that you can show adequate safeguards if asked.
Whichever you rely on, keep the record. "Proof" is the word the Act uses for safeguards, and a consent you cannot produce is hard to rely on.
When an impact assessment comes first
The Act requires a data protection impact assessment before processing that is likely to result in high risk to data subjects, with the report submitted sixty days before the processing begins. If the assessment shows high risk, the Data Commissioner must be consulted first.
A single family holiday is unlikely to raise that question on its own. An agency planning something larger, such as a new system that collects and shares passport details for every traveller automatically, or a programme handling groups of minors travelling abroad, should consider whether an assessment is needed, and plan for the lead time.
Passport details in the Travel pack
The Travel & tourism pack in Achekam's Industry CRM keeps Bookings, with their travellers and itinerary legs, and Traveller profiles that hold passport details and preferences with the traveller's consent. Consent is part of the profile, not an afterthought.
The pack's booking workflow sends the traveller trip questions and a travel quote, requests passports and visas, has the booking terms accepted electronically, invoices the deposit, confirms every leg and issues tickets and vouchers. Because the passport request is a step in the workflow, the agency asks for documents when the booking needs them, rather than collecting them in advance just in case.
When a supplier abroad needs a copy, a shared link is safer than an attachment. A document can be shared by e-mailing a personal link with an expiry, an optional one-time code and download allowed or not, and the share can be revoked. A hotel that needs to see a passport at check-in can be given view-only access that lapses after the stay, instead of a file that sits in its inbox indefinitely.
Traveller profiles in the booking pipeline explains how profiles fit into a booking, and storing passport copies safely covers the agency's own copies.
Before the next booking abroad
Add a consent paragraph to your booking terms that names the kinds of supplier abroad that will receive passport details, list the details each supplier type really needs, and decide how long passport copies stay on file after a trip ends.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
