Kenya’s National Assembly passed the Finance Bill 2025 on June 19. However, MPs removed a controversial clause that would have allowed the KRA access to personal data like bank and mobile money records, including trade secrets and personal data.
KRA access to personal data: What changed?
MPs debated and rejected the clause after concerns over privacy. The Finance Committee, led by MP Kuria Kimani, ruled that granting KRA such access would violate Article 31(c) & (d) of the constitution, which guarantees privacy source?
They reminded lawmakers that Section 51 of the Data Protection Act (2019) only permits such data access under strict conditions. Hence, the Legislature agreed that a judicial warrant must guide any data request.
Why MPs pushed back
MPs noted that KRA already has sufficient legal tools, including court-issued warrants, to access taxpayer data. These are adequate to curb tax evasion without compromising privacy. The committee emphasized balancing tax compliance with due process.
What KRA said
Treasury Cabinet Secretary John Mbadi and KRA Chairperson Ndiritu Muriithi had defended the controversial clause. They argued that unrestricted data access would boost tax compliance. According to Mbadi, many Kenyans under-declare tax even though they can pay more. Muriithi noted that around 10 million of 20 million PIN holders file returns, but 6 million file nil returns.
Next steps in Finance Bill 2025
With KRA access restricted, the bill now awaits the President’s assent. Observers expect the President to sign it swiftly since MPs passed it by voice vote (acclamation).
Implications for data privacy and tax enforcement
By rejecting KRA’s blanket data access, Parliament reaffirmed Kenyan data protection standards. Now, KRA can still seek data, but only using warrants. This change also prompts the tax agency to leverage existing systems like third-party reporting, analytics, and voluntary compliance.
Read Also: How to File KRA Nil Returns on eCitizen in 2025
What to watch next
- President’s assent—He should sign soon.
- KRA compliance—They must now use warrants.
- Regulatory enforcement—Watch updates from the Office of the Data Protection Commissioner (ODPC) on Data Protection Act enforcement.
- Public reaction—Some privacy advocates have already praised the Parliament’s move.
