Kenya's Office of the Data Protection Commissioner (ODPC) has levied substantial penalties against several digital lenders, savings and credit cooperatives (SACCOs), and insurance companies for breaches of the Data Protection Act, 2019. The regulator's enforcement actions, detailed in recent decisions, highlight a crackdown on the unauthorized processing and sharing of personal data.
Among the penalized entities, digital credit provider Zenka Digital Limited was fined KSh 1.85 million for unlawfully processing a complainant's personal data and failing to cooperate with the investigation. The ODPC also ordered the company to compensate the affected individual. Similarly, insurance company Madison Insurance was fined KSh 1.95 million for using a client's personal data to issue a policy without consent.
The ODPC has mandated multiple firms to pay compensation directly to data subjects whose rights were violated. In one case, a SACCO was ordered to pay KSh 100,000 to a complainant for unlawfully sharing their personal data with a third party. The regulator stated these actions demonstrate its commitment to enforcing compliance and protecting citizens' privacy rights under the law.
These penalties are part of a broader enforcement trend by the ODPC, which has been actively investigating complaints and auditing data controllers. The commissioner has urged all organizations to ensure their data processing activities are lawful, transparent, and for specified purposes, warning of continued strict enforcement against non-compliant entities.
