Public surveillance does not replace property security: A privacy-first guide for Kenya

Public surveillance and property security serve different purposes

Kenya is part of a wider African discussion about expanding public surveillance infrastructure. Research reported by CIPESA identifies Kenya among at least 11 African governments that have invested in AI-enabled surveillance infrastructure involving technologies such as cameras, biometric data collection, and facial recognition in public spaces. The reported combined investment across those countries exceeds US$2 billion.

Whatever the public-policy case for such systems, public surveillance is not a dedicated protection plan for an individual home, shop, office, estate, or warehouse. A property owner still needs to decide which access points require protection, how an alert will be verified, who should receive it, and what action follows when a specific property is at risk.

The practical difference for a property owner

Street-level or public-area surveillance may assist wider public safety objectives. A private property system is different: it should be configured around the spaces under your care, the authorised people who need access, and the response procedure you have agreed.

CCTV should be designed around a defined risk

CCTV can support deterrence, investigation, and incident verification when it is positioned around legitimate security needs. Relevant areas may include gates, entrances, parking approaches, storefront access, stockroom doors, loading bays, selected corridors, and boundary lines.

A camera should not be installed simply because coverage is technically possible. Before any installation, the property owner should be able to explain what risk each camera addresses, who may access footage, how people are informed, and how records will be protected and retained.

Kenya's Data Protection Act requires personal data to be collected, stored, or used for a purpose that is lawful, specific, and explicitly defined. For a security system, that principle supports purposeful coverage rather than unnecessary observation.

Visitor records and identification require professional handling

Visitor identification can be part of a lawful access-control procedure at controlled premises. Under section 48 of Kenya's Private Security Regulation Act, a security guard or officer may request identification at premises under the care of a private security service provider, register entrance and exit time, and temporarily retain an identification document.

That authority comes with clear limits. A temporarily retained identification document must be returned at exit, kept safely while held, and not used for any purpose other than identification. Information obtained during visitor registration is also restricted to the identification purpose, subject to the Act.

For a professional property operator, the operational lesson is straightforward: visitor procedures should be documented, respectful, secure, and limited to the information required for the stated security purpose.

Control who can access your security data

A security installation may generate CCTV recordings, access logs, alarm events, visitor records, or verification images. Those records can become a risk if administrative access is unclear, old users remain active, passwords are shared, or footage is retained without a defined purpose.

Before handover, property owners should understand where footage and event records are stored, who holds administrator access, which users can view or export records, how remote access is removed when roles change, and what procedures apply after an incident.

The ODPC's draft guidance for private security addresses data-protection controls relevant to CCTV, visitor records, biometric systems, and access-control processes in security operations. The document is draft guidance, but it provides useful context for the questions property owners and security providers should be prepared to address.

Alarm verification can reduce unnecessary monitoring

Not every site requires continuous indoor video recording. In many homes, offices, and short-stay properties, a proportionate plan may combine door contacts, glass-break detection, motion sensors, panic support, and event-triggered verification where the selected system supports it.

This approach focuses attention on defined alarm events rather than ordinary day-to-day activity. It still requires careful configuration: access permissions, alert recipients, monitoring procedures, image availability, and data handling should all be agreed before the system goes live.

What to ask before approving a security system

A quotation should explain not only which equipment will be supplied, but also the information the system will collect and the procedures that govern it.