Research / Data protection and AI / Tracker
FNJ analysis · Updated quarterlyKenya Data Protection Enforcement Tracker
The determinations published by the Office of the Data Protection Commissioner, analysed by sector, issue, outcome and remedy, to show where enforcement is concentrated and what non-compliance costs.
Coming soon · Covers determinations published from 2024 · Updated quarterly
2026 so far
23
determinations listed by the Commissioner for 2026
1
own-motion investigation, against a SACCO
Provisional: FNJ's classification of the Commissioner's 2026 list, before the determinations are coded in full.
Source: the Commissioner's 2026 determinations list. Counts for 2024 and 2025 are added in the first edition, once duplicate uploads in those lists are removed.
Determinations
Showing 5 of 5 determinations from 2026, read in full on 24 October 2026. Organisations are described by subsector; no organisation or individual is named.
| Date | Respondent (described, not named) | Sector | Issue | Outcome | Remedy | Reference |
|---|---|---|---|---|---|---|
| 14 Apr 2026 | A microfinance bank | Banks and microfinance | Former employee's images posted in public notices on Facebook; no response to the complaint notice | Found liable | Erase the images within 14 days or face an enforcement notice; prosecution of directors recommended | ODPC Complaint No. 0213 of 2026 |
| 8 Apr 2026 | An events and hospitality company | Hospitality and events | Person's image used to promote an event without express consent | Found liable | Compensation of KES 300,000 | ODPC Complaint No. 2175 of 2025 |
| 16 Mar 2026 | A private specialist hospital | Healthcare | Medical results of another patient issued to the complainant; sample sent to a third-party laboratory without explicit consent | Found liable | Compensation of KES 525,000 | ODPC Complaint No. 2125 of 2025 |
| 11 Mar 2026 | A digital lender | Digital lenders | Loan-recovery messages sent to a person who had not taken the loan; no response to the complaint notice | Found liable | Enforcement notice | ODPC Complaint No. 2036 of 2025 |
| 11 Mar 2026 | A dry-cleaning business | Consumer services | Marketing SMS sent repeatedly after the customer opted out | Found liable | Enforcement notice | ODPC Complaint No. 2024 of 2025 |
What the determinations show
- Two of the five respondents did not answer the Commissioner's notice of the complaint, and both were found liable.
- Compensation followed the misuse of sensitive health data (KES 525,000) and a person's image used to promote an event without consent (KES 300,000).
- Marketing messages sent after an opt-out, and loan-recovery messages sent to someone who was not the borrower, both led to enforcement notices.
Based on the five 2026 determinations above. Future editions will set out the patterns across all determinations in the period.
What to do now
- Respond to all notices from the Commissioner within the time it allows, and keep a record of the reply.
- Get express consent before using a person's image or contact details for marketing, and act on opt-outs at once.
- Limit debt-collection contact to the borrower, and check the number before sending recovery messages.
How we build the tracker
- Source: the determinations the Commissioner publishes on odpc.go.ke for 2024 onwards, and appeals reported on Kenya Law.
- Determinations are read in full and coded for date, respondent, sector, issue, outcome and remedy, with a link to the Commissioner's published list.
- Organisations are described by subsector and size, never by name. Individuals are never named.
- Figures come only from the Commissioner's own determinations. Other analyses are used only to check our counts, never quoted.
- This tracker is FNJ's analysis of published decisions. It is not an ODPC compliance audit, and FNJ is not an ODPC-accredited audit firm.
Disclaimer
This tracker is general information based on determinations published by the Office of the Data Protection Commissioner. It is not legal advice. Determinations may be appealed or set aside; confirm the current position in the original document before relying on it. FNJ & Associates accepts no liability for decisions made on the basis of this tracker.