Voter Registers, Biometric Kits, and Data Integrity: What an Election Ruling Means for Kenya’s Tech Sector

It isn’t often that an election petition doubles as a data-governance case study, but the High Court’s recent decision in Newton Kariuki Ndwiga v IEBC & 3 Others (Election Petition No. E002 of 2025, High Court at Embu, delivered 21 May 2026) is exactly that. At its core, part of the dispute was a data-integrity question: what happens when a “frozen,” supposedly immutable database is altered by a single authorised user’s mistake, and how do you prove, after the fact, that the alteration didn’t compromise the whole system?

CB Mwongela & Co. Advocates represented the Independent Electoral and Boundaries Commission (IEBC) and its officials in successfully defending the petition, which was dismissed with costs. For companies operating biometric systems, identity platforms, or any database subject to a regulatory “freeze” or audit requirement, the case is worth a close read.

During the by-election, the voters’ register  legally “frozen” as of a set date, was found to contain one new entry, added weeks later by a registration officer using an “open” biometric kit elsewhere in the country. The officer himself admitted the entry was, in law, an unauthorised alteration of the register.

That single fact could have been catastrophic for confidence in the entire system. Instead, the Court accepted that the register’s overall integrity had been preserved, because:

The error was isolated and explainable: a single named officer, a single date, a specific human cause (an overwhelmed registration desk).

It was caught and flagged internally, before litigation, through the organisation’s own IT function.

The downstream safeguard worked: the flagged entry was blocked from being used to cast an actual vote, and this was independently verifiable against the system logs.

Critically, there was no audit evidence of a wider pattern: no proof the same failure had happened elsewhere in the database.

The legal lesson: incident response is a defence, not just an IT function

For any organisation running systems that must remain verifiably accurate  (biometric identity platforms, financial KYC databases, health records, telecom SIM registries) this case illustrates a point that often gets lost between the legal and technical teams: how you respond to a data error matters as much as the error itself.

A court (or a regulator) asking “was your data compromised?” is really asking three questions:

Was the anomaly detected and reported promptly, ideally by the organisation itself rather than an outside party?

Was there a downstream control that prevented the anomaly from causing real-world harm?

Can you prove, with logs and audit trails, that the anomaly was contained rather than systemic?

Where an organisation can answer yes to all three, isolated data-integrity failures are unlikely to be treated as fatal to the credibility of the entire dataset. Where it cannot  (because there’s no audit trail, no incident report, or no way to check for a wider pattern) the same failure becomes far harder to defend.

Why this matters for regulated tech and data-driven businesses

As data protection enforcement in Kenya matures, organisations handling sensitive identity or biometric data should expect the same standard the Court applied here: not perfection, but demonstrable, documented incident response. Building that discipline  (logging, flagging, escalation, and an audit-ready paper trail) before an incident happens is far cheaper than trying to reconstruct it afterward under legal pressure.

CB Mwongela & Co. Advocates advises technology, fintech, and data-driven businesses on data governance, incident response, and defending data-integrity challenges before courts and regulators. Talk to us about protecting your organisation’s data credibility.