Members of Parliament have blocked the Kenya Revenue Authority (KRA) from accessing firms’ trade secrets and customer data to assess the businesses for tax.
The Parliamentary Committee on Finance and National Planning quashed a second attempt by the taxman to have unfettered access to the detailed transactional data on companies, months after the National Treasury unsuccessfully moved a similar proposal in December last year.
KRA had been banking on this unchecked access to aid in the integration of the electronic tax system with the firms’ systems to weed out revenue loss through tax evasion.
The plan has been under heavy scrutiny with opponents arguing the move would result in the loss of confidentiality protection for trade secrets and pose data protection and security risks to the personal data of customers, employees and clients.
While dropping the proposal contained in the Finance Bill, 2025, the Finance and National Planning Committee said the unfettered access to personal data would result in a breach of the right to privacy.
“In the matter of granting the Kenya Revenue Authority (KRA) sweeping access to personal data for tax compliance purposes, particularly where trade secrets or personal customer data are involved, the committee observed that that the proposed provision does not meet the threshold set out under Article 31c and (d) of the Constitution of Kenya, which guarantees the right to privacy,” the committee said in a report published on Monday.
Representatives of the private sector including consultants at KPMG and law firm Oraro and Company advocates pushed for the dropping of the proposal citing the violation of privacy rights.
In a previous note on the Finance Bill, 2025 proposals, KPMG warned that allowing KRA unfettered access to personal data would erode Kenyans' trust in the taxman while violating other laws that guard against the breach.
“Businesses may be forced to disclose personal customer information, raising concerns about data protection, compliance with privacy laws, and potential misuse or breaches,” KPMG said in a note.
“The absence of confidentiality and data privacy protections could erode taxpayer trust in KRA leading to resistance or non-compliance with data submission requirements. Additionally, the requirement for disclosure of trade secrets data and personal data violates the Data Protection Act and Industrial Property Act.”
KRA has already been facing backlash from firms in its attempt to integrate its systems with businesses over fear of access to private data.
Commercial banks have, for instance, blocked the push by the taxman to integrate its system with their own, fearing KRA could access sensitive private information like the flow of cash in accounts.
Law changes in December gave KRA power to compel a taxpayer to integrate its system with that of the authority in efforts to weed out tax evaders and boost revenue collection.
The law at the time, however, blocked the taxman from requiring the integration of data relating to trade secrets and private or personal data held on behalf of customers or collected in the course of business.
The parliamentary committee argues that KRA has remedies to access personal data and trade secrets but under the guidance of pre-existing laws.
“The committee noted that section 51 of the Data Protection Act prescribes clear conditions under which exemptions to data protection may be permitted,” the committee said.
“In addition, section 60 of the Tax Procedures Act already grants the Commissioner or an authorized officer sufficient legal authority to access necessary data for tax administration, subject to the requirement of obtaining a court-issued warrant. In light of these existing safeguards, the committee concluded that the proposed provision is both unnecessary and potentially unconstitutional.”
The Data Protection Act grants general exemptions including situations where the processing of personal data by an individual is in the course of purely personal or household activity.
Exemptions to the provisions of the Act are also granted in a matter of national security or public interest and where the disclosure is required by or under any written law or by an order of the court.
KRA has remained diplomatic in the face of opposition against the integration of systems, noting previously that it was engaging various stakeholders for collaboration in co-creating innovative solutions that facilitate tax compliance.
A plan to access personal sensitive data like the details of properties owned, bank accounts, and cash transfers on mobile phones was also crushed by the defeat of the Finance Bill, 2024.
