Three Entities hit with over Kshs. 9 million fine under Kenya data protection laws
The Office of the Data Protection Commissioner (ODPC) announced on 26 September 2023, over
Kshs.9 million fine against three entitles namely KeCredi, Casa Vera Lounge and Roma School.
The decisions against the four entitles imposed a fine Kshs.2,975,000.00 against Mulla Pride Ltd
trading as KeCredi for using contact information obtained from third parties and making threatening
calls or sending messages to those contacts. Casa Vera Lounge, a restaurant based in Nairobi, was
found to have shared a reveller’s photo on social media platform in absence of a consent and was
Finally, Roma School was fined Kshs. 4,550,000.00 for publishing minors’ images without the
consent of their parent.
The decision by the Data Protection Commissioner signals that entitles operating in Kenya now have
a lot of risk on the table.
The Data Protection Commissioner is also announced that it is investigating WhitePath, a digital
credit provider and Naivas Supermarkets for a separate violation of Data Protection rules, whose
verdict should soon be disclosed to the public.
It is important for businesses and advocates to know that Data protection authorities in Kenya are
turning their focus to how entitles are handling data. There has been overall increase in fines this
year and the fine of Kshs. 4,550,000.00 that Kenyan authorities levied against Roma School recently
remains one of the biggest to be issued.
There is growing confidence and willingness by the Data Protection to impose high fines for
of the Data Protection Rules particularly against large business.
The sizes of the fines have grabbed many headlines and business are being asked to do everything to
ensure that they uphold data protection laws. Data Commissioner has urged all entities to abide by
Data Protection Act and particularly to implement data protection principle and safeguards.
The heavy fines imposed and the growing willingness by the Data Protection authorities is a wake-up
call for advocates to pay more attention in assisting business comply with Data Protection Act and
business to comply with their obligations under the Act.
If you are an entity operating in Kenya and you want to achieve full compliance with Data Protection
Act. Advocate Getter is happy to find a trainer or an advocate to assist you to achieve full
compliance and manage the risk of non-compliance.
Click Here to find a trainer or an advocate or click here to contact us today.