No More ID Numbers on a Page: How Nairobi Estates Are Protecting Their Visitors’ Information

Kenya’s Office of the Data Protection Commissioner (ODPC) has put the gate logbook on notice. Its draft guidance for private security, published in December 2025, sets out what goes wrong when a building keeps visitors’ names, ID numbers and phone numbers in a hardcover book at the desk.

The twist sits in the guidance itself, which tells two stories. In the first, a guard tells a departing chief executive that the building still holds her details from her first visit, and that the book’s first entry was made in 1986. In the second, a guard takes the register home, loses it in a pub, and the visitors’ details surface on a website used to defraud them.

What the law asks of the gate

The law allows the guard’s questions. Section 48 of the Private Security Regulation Act lets guards ask visitors to identify themselves and record their entry and exit. The duty falls on how the record is kept: the Data Protection Act requires a stated purpose, a defined retention period and secure storage, and the Data Commissioner can fine up to KSh 5 million.

Estates are now moving to GuestPass, where visitor records are handled the way the Data Protection Act and the ODPC’s guidance ask. Picture the same visitor at a GuestPass gate. The guard fills in a short form on the gate phone and sends it in, and the resident gets a text to approve the visit. Once the gate has the approval, the record is stored offsite, where it stays secure.

The result is a gate that knows exactly who came in, while every visitor’s details stay protected.