Kenya passenger data record

The legal basis for API and PNR

The Kenya Citizenship and Immigration (Amendment) Regulations, 2023 are Legal Notice No. 1, dated 1 January 2024 and published in the Kenya Gazette on 2 January 2024 ¹. They are made under section 59 of the Kenya Citizenship and Immigration Act, 2011 ¹.

Regulation 16A requires carriers, operators or agents to submit API and PNR data to the Director in the manner set out in the Tenth Schedule and within the timeframes in the Thirteenth Schedule ¹. Carriers must register with the Director before they submit data ¹. Regulation 16D sets an administrative penalty of US$10,000 for inaccurate or misleading data, and the Fifteenth Schedule describes it as not exceeding US$10,000 ¹. The Director may recover it as a civil debt ¹.

What data airlines send and when

The Tenth Schedule lists the data in four parts ¹. API covers flight details and passenger and crew details such as travel document data, nationality, date and place of birth, gender, seat, baggage, visa details and addresses ¹. PNR covers names, contact and billing details, frequent flyer data, booking and ticketing dates, itinerary, payment forms and remarks ¹.

API is due for arrivals and departures, when data changes and when boarding is complete ¹. PNR is due 24 hours before scheduled departure, or up to 2 hours before if not available earlier, and again when boarding is complete or after start of taxi ¹. API uses the UN/EDIFACT PAXLST format and PNR uses the IATA PNRGOV standard ¹.

Who can see the data and how long it is kept

An immigration officer may compare API and PNR data against watch lists and may process it under the Data Protection Act, 2019 ¹. Where a traveller needs further examination, the officer gives access to a control agency, subject to the same Act ¹. The control agencies are the Directorate of Immigration Services, units of the Directorate of Criminal Investigations, the National Intelligence Service, Kenya Revenue Authority Customs and Port Health ¹.

Six months after receipt, the Director must depersonalise the data by masking names, addresses, contact details and frequent flyer information ¹. The Director may reverse this to prevent, detect, investigate or prosecute a specified offence ¹. Data needed for an investigation or court case on a specified offence may be kept for no more than five years from receipt ¹. The Twelfth Schedule lists 28 specified offences, including terrorism, human trafficking, corruption and any customs or revenue offence ¹.

The fee and the SITA gateway

Kenya Civil Aviation Authority circular AIC 14/25, published 23 October 2025, sets a fee of US$4.95 per passenger per international journey segment ⁴. It applies to arrivals, departures and transits, and crew on duty are exempt ⁴. The circular states the fee covers the cost of capturing, transmitting, processing and administering API/PNR data ⁴.

The circular names SITA as the service provider that carriers must integrate their payment systems with by 1 December 2025 ⁴. The Directorate's carrier page says SITA issues a Payment Undertaking that all carriers must sign, and fees are remitted through the SITA gateway for onward settlement to Government ⁶. Invoices are based on API/PNR data that carriers send to the Directorate ⁶. Neither record states the contract term, the hosting arrangements or which party holds the data ^4,6.

On 30 July 2026 IATA, AFRAA and AASA issued a joint statement asking African governments not to fund API and PNR programmes through charges on airlines or passengers ⁹.

Biometrics at the border

The Directorate of Immigration Services tells arriving travellers to present themselves for the capture of biometrics, so that facial photographs and fingerprints can be taken ⁷. The Embassy of Japan in Kenya reported a handover ceremony on 30 September 2019 for a facial recognition system at Moi International Airport, Mombasa ⁸. The embassy said the system was designed by Nippon Electric Company, supported by the Government of Japan and organised by the IOM Kenya Office ⁸.

Chronology