Marketing messages you never agreed to receive. A digital lender calling your relatives about your loan. A company that refuses to delete your details. Your personal information exposed in a data breach. These are not just irritations. Under Kenyan law they can be violations of your right to privacy, and they come with real remedies.
The legal framework
Article 31 of the Constitution protects the right to privacy, including the right not to have information about one’s private affairs unnecessarily required or revealed. The Data Protection Act, 2019 gives practical effect to that right. It applies to any organisation that collects or uses personal data in Kenya, from banks and lenders to schools, hospitals, employers, landlords and online platforms.
The Act is enforced by the Office of the Data Protection Commissioner (ODPC).
Your rights as a data subject
Under section 26 and related provisions of the Act, you have the right to:
- be informed of how your personal data will be used;
- access the personal data an organisation holds about you;
- object to the processing of all or part of your personal data;
- have false or misleading data corrected; and
- have false, misleading or unlawfully processed data deleted.
You also have protections against the use of your data for direct marketing. As a rule, an organisation must have your consent or another lawful basis to send you marketing, and it must stop when you ask it to.
What organisations must do
Organisations that handle your data, called data controllers and data processors, must follow the data protection principles in section 25. They must process data lawfully, fairly and transparently. They must collect only what they need, for a clear purpose. They must keep data accurate and secure, and retain it no longer than necessary.
They must also have a lawful basis for processing, such as your consent, a contract with you or a legal obligation. Collecting a borrower’s phone contacts and using them to shame the borrower over a debt is a common example of processing that the ODPC has found unlawful.
Step 1: Raise it with the organisation
Before going to the ODPC, it is usually best to write to the organisation, ideally to its data protection officer. Set out your request clearly. You might ask for a copy of your data, for it to be corrected or deleted, or for marketing to stop. Keep a copy of your letter or email and note the date. A written request also creates useful evidence if the organisation ignores you.
Step 2: File a complaint with the ODPC
Under section 56 of the Act, a data subject who is aggrieved may lodge a complaint with the Data Commissioner. You can file through the complaint form on the ODPC website. Your complaint should include:
- your details and the details of the organisation complained against;
- a clear account of what happened and when;
- the right you believe has been infringed; and
- supporting evidence, such as screenshots of messages, call logs, correspondence and any response from the organisation.
The process follows the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021. The ODPC acknowledges the complaint, notifies the organisation and invites a response, and then investigates.
Under section 56(5), a complaint must be investigated and concluded within ninety days. The High Court has held that determinations made outside this period are made without jurisdiction. Keep track of the dates.
What the ODPC can order
If the complaint is upheld, the Data Commissioner can:
- issue an enforcement notice requiring the organisation to take specific steps, such as deleting data or stopping a practice;
- issue a penalty notice imposing an administrative fine; and
- order the organisation to pay you compensation under section 65. Compensation covers financial loss and also damage not involving financial loss, such as distress.
Either party may appeal a determination to the High Court within 30 days.
Common complaints we see
- Unsolicited marketing SMS messages and calls, including after an opt-out request.
- Digital lenders contacting a borrower’s family, friends or employer.
- Wrongful listing with a credit reference bureau.
- Refusal to provide or delete personal data on request.
- CCTV, biometric or employee monitoring without proper notice.
- Data breaches and leaked personal information.
Frequently asked questions
Does it cost anything to complain to the ODPC?
No. Filing a complaint with the ODPC is free.
Can I go to court instead?
Section 65 gives a right to compensation, and privacy violations can also found a constitutional petition. Which route is best depends on your goals, the evidence and the timelines, so take advice.
How long do I have to complain?
Act promptly. Evidence such as messages and call logs is easier to preserve while it is fresh, and delay can weaken a complaint.
How we can help
Data protection is a core area of our practice. We advise individuals on complaints to the ODPC, compensation claims, appeals and related constitutional petitions. We also advise organisations on compliance. If your data rights have been violated, contact Odek Law Advocates.
This article provides general information on Kenyan law as at October 2026 and is not legal advice. Please seek advice on your specific situation.