A Kenyan court just changed the rules for every organization that collects personal information. Think about every organization that has your data right now: your mobile network, bank, health insurer, the security system that scanned your ID at the door, the betting app that knows your transaction history, and the government agency that issued your documents. Every one of them holds information about your location, finances, identity, and behaviour in a database you have never seen and cannot access. Until mid-May 2026, many of these organizations operated under a comfortable assumption: as long they did not intend for something to go wrong, they would not be responsible if it did.