The ODPC Record: How Kenya Enforces Data Protection

1. Executive summary

Six findings from the full published record.

1. Kenya is the only African jurisdiction whose regulator can be studied statistically. The ODPC contributes 301 of the tracker's 595 verified records: 299 individual reasoned determinations, published as documents, at a volume no other African authority approaches. Everything in this report follows from that publication practice, and nothing like it exists for Nigeria, South Africa or any francophone regulator. The record runs from 12 June 2023 to 14 April 2026.

2. The published record is a curated sliver of the caseload. The ODPC's own case numbering, cited in its determinations, shows at least 6,407 complaints filed between 2023 and 2025. Published determinations from those filing years: 256, or 4.0%. The office decides far more than it publishes, and what it publishes is the visible edge of a much larger docket.

3. The office is fast. Of the 258 determinations whose case number states a filing year, 67% were decided within the calendar year the complaint was filed, and 100% within the next. No complaint in the published record waited longer than that. For a regulator this young, working through thousands of filings, that speed is the most underreported fact about it.

4. A complaint that reaches determination usually wins, and silence is fatal. 84% of adjudicated complaints were upheld. Respondents who did not participate in proceedings, 67 of 303 matters, lost 93% of the time. The single most reliable way to lose before the ODPC is to ignore it.

5. The money is small, concentrated and now executable. The median compensation award is KES 650,000 (about USD 5,050); the five largest awards account for 54% of everything ever ordered. Misusing a person's image for marketing is the expensive violation: median KES 3,500,000 across 12 awards, against KES 450,000 for debt-collection matters. And since the High Court adopted an ODPC award as an order of the court in February 2026, an award is no longer a strongly worded letter. It is an executable debt.

6. The deterrent is not the fine. No administrative penalty notice appears in the published determinations corpus; the ODPC's known penalties were announced by press release and never published as documents. What the record actually contains is 169 enforcement notices, 28 prosecution recommendations and a compensation regime priced for individual dignity harms. Kenyan enforcement bites through process, publicity and now execution, not through headline fines.

2. From commencement to the publication era

The Data Protection Act, 2019 commenced on 25 November 2019. The office it created took a year to get a head: Immaculate Kassait was sworn in as Kenya's first Data Commissioner on 16 November 2020, for a single six-year term. Three regulation sets followed in 2021 (General; Registration of Data Controllers and Data Processors; Complaints Handling and Enforcement), and the registration regime opened in 2022 [W-CHECK: confirm the registration go-live date, commonly given as 14 July 2022, against the ODPC's own notice before publication].

The enforcement record as a readable corpus begins on 12 June 2023, the date of the earliest determination in the published set, a digital-lending matter brought by 23 complainants whose contact lists had been harvested for debt collection. From there the office published 46 tracked actions in 2023, 117 in 2024, 98 in 2025 and 42 in H1 2026, with 2025 Q4 the busiest quarter on record (44 actions).

lag, not decline. Source: tracker.*

Four dates mark the record's turning points.

26 September 2023: the first penalties. The ODPC announced penalty notices totalling KES 9,375,000 against three organisations: Mulla Pride Limited (KES 2,975,000, a digital lender using harvested contacts for threatening collection calls), Casa Vera Lounge (KES 1,850,000, a patron's image posted without consent) and Roma School (KES 4,550,000, minors' images published without parental consent) (DataGuidance; Cliffe Dekker Hofmeyr) [W-CHECK: penalty figures rest on the ODPC's September 2023 press statement as reported by the linked sources; the notices themselves were never published. Verify the trio and amounts against the ODPC statement, and note the Casa Vera determination of 17 July 2023 in the tracker is a separate, earlier instrument ordering KES 5,000,000 in compensation]. Those three numbers did more for Kenyan compliance budgets than the Act's first three years combined. They are also invisible: because the notices were never published as documents, they exist in this report's narrative and cannot exist in its statistics.

6 September 2023: the regulator moves on its own. The ODPC's suo motu determination against the Worldcoin Foundation took on iris-scanning crypto onboarding without waiting for a complaint. The High Court completed the arc on 5 May 2025, declaring that Worldcoin's biometric collection contravened Article 31 of the Constitution and the Act, and the episode became African data protection's most-cited technology case. Our full reading: the Worldcoin ruling.

16 February 2026: awards become debts. In Muthoni v Africa International University the High Court adopted a KES 250,000 ODPC compensation determination as an order of the court under sections 64 and 65 of the Act. Everything in chapter 4 of this report carries execution risk from that date. Analysis: ODPC determinations now have teeth.

April 2026: frontier hardware. The ODPC opened a suo moto investigation into Ray-Ban Meta smart glasses, the first African regulatory action on always-on wearable cameras [W-CHECK: record is media-sourced; check whether the ODPC has published its own notice and upgrade the source if so]. A complaints regulator has started asking technology-first questions. Briefing: wearables, biometrics and the ODPC.

One institutional date belongs in every Kenyan compliance diary: Commissioner Kassait's single six-year term runs from November 2020, so the office changes hands in late 2026. The record this report describes is substantially one Commissioner's record. Whether the pace, the publication practice and the suo motu appetite survive the succession is the open question of 2027.

3. The pipeline: what happens to a Kenyan complaint

The Act's complaints machinery (s.56, cited in 360 records, more than any other provision) works like this in practice: a data subject files, the office investigates (with a site visit in 61 tracked matters), the respondent answers or does not, and a determination issues, sometimes with orders attached. The published record lets us measure each stage.

Speed. 265 records carry the ODPC's own case number ("ODPC Complaint No. 436 of 2023"), and 258 of those state a filing year. 67% were determined in the filing year itself; 100% by the end of the following year; none later. Kenyan complainants get answers in months, not years, and respondents should assume the same tempo.

Volume, and the visibility gap. Case numbering is sequential, so the highest number cited in a year is a floor on that year's filings:

as cited in published determinations. Source: tracker.*

At least 6,407 complaints were filed across 2023–2025; 256 published determinations trace to those filing years. Some of the difference is resolution without adjudication (mediation, withdrawal, out-of-scope referrals), some is determinations that exist but were never uploaded. The record does not let us apportion it [W-CHECK: the floor methodology (max case number cited = minimum filings) is an inference from the numbering scheme; confirm you are comfortable publishing it, and consider pairing it with the ODPC's own annual-report complaint statistics when citing totals]. Either way, the practical point for practitioners stands: reading the published corpus is reading a 4.0% sample, curated by the regulator, of what the office actually handles.

Participation, or the cost of silence. In 67 matters (22% of the record) the respondent simply never engaged: no response to the complaint, no appearance, nothing. Those respondents lost 93% of the time (62 upheld against 5 dismissed). The office decides on the material before it, and an empty chair concedes the complainant's version. Compare the overall uphold rate of 84%: showing up with records is worth roughly ten percentage points, and not showing up converts a defensible complaint into a lost one.

What a determination produces. Of 295 adjudicated complaints, 248 were upheld and 47 dismissed (3 more resolved between the parties). An upheld complaint usually brings an enforcement notice (63% of upheld matters) directing specific remediation on a deadline; compensation is rarer (15% of upheld matters); and 28 matters ended with a recommendation of criminal prosecution, 11 of them attached to complaints the office otherwise dismissed. That last pattern deserves attention: a respondent can win the complaint and still be referred for prosecution, typically for obstruction or for operating unregistered. The complaint and the offence are separate tracks.

tracker.*

Complainants are almost always individuals (9 matters were brought by groups, the largest by 23 co-complainants against a digital lender). Respondents are mostly private organisations (291 of 303, 96%), with 4 public bodies and 8 named individuals. This is a consumer-protection docket in data protection clothing, and the office's statistics mirror what ordinary Kenyans experience as privacy harm.

4. The money: compensation jurisprudence, median first

Kenya's monetary regime is compensation to the data subject under s.65 (cited in 252 records), not fines to the state. The published corpus contains 38 compensation orders totalling KES 69,238,907 (about USD 525,280 at documented year-average rates).

tracker.*

The distribution matters more than the total:

• Median award: KES 650,000 (about USD 5,050).
• Mean award: KES 1,822,076, nearly three times the median, because five awards do 54% of the work. Exclude them and the mean falls to KES 966,530, the median to KES 500,000.
• Range: KES 2,000 to KES 10,000,000. The smallest award in the record, KES 2,000 against a business called Chapeo, sits in a matter that still produced an enforcement notice and a prosecution recommendation. Award size and seriousness are not the same axis.

The five awards that move the mean deserve their names:

The three largest are all image cases. That is the jurisprudence in one table: the unauthorised commercial use of a person's image is the most expensive thing a Kenyan organisation can do with personal data. Across the 12 awards involving image misuse the median is KES 3,500,000; across debt-collection awards it is KES 450,000. The ceiling case, KES 10,000,000 against Oxygene Marketing for using a prominent athlete's image in a campaign, and the KES 9,043,407 order against NCBA Bank (a customer's image kept in marketing use after an erasure request) show the pattern at both corporate scales: public figures collect headline awards, and the same violation prices in the millions even when the complainant is not famous, as in Casa Vera Lounge's KES 5,000,000 determination over a patron's photograph.

Three practice notes complete the money picture. First, compensation reaches only 15% of upheld complaints; the office treats it as a remedy for demonstrated harm, not an automatic consequence of winning. Second, quantum reasoning is thin in the source documents, which is why this report gives distributions rather than a predictive formula. Third, the numbers are no longer soft: after Muthoni, a respondent who ignores an award faces execution, not another letter.

What the money chapter cannot contain is as instructive as what it does. The Act caps administrative penalties at KES 5,000,000 or one per cent of annual turnover, whichever is lower (s.63), the inverse of the GDPR's whichever-is-higher design, and the ODPC's known penalty notices (September 2023, chapter 2) were press-released rather than published. Kenya's published enforcement economics are therefore compensation economics. A controller modelling exposure on GDPR-style fine curves is modelling the wrong regime [W-CHECK: s.63 characterisation is from the Act's text as summarised in the laws library record; confirm the "whichever is lower" reading against the statute before publication].

5. The taxonomy: what gets enforced, under which sections

Every violation category in the dataset maps to the Act sections the ODPC actually cites. The full table:

A record can cite several categories. "Unlawful processing" (95% of the record) functions as the umbrella finding that accompanies specific violations, not as an independent category.

Mapped to the provisions cited alongside them:

And the provisions ranked directly:

Reading the two tables together gives the working anatomy of Kenyan enforcement:

• s.25 (principles) and s.26 (data subject rights) are the substantive core, cited in 350 and 262 records respectively.
• s.56 (complaints) and s.65 (compensation) are the procedural spine.
• s.30 (lawful processing) and s.32 (consent) carry the consent caseload: 142 records cite lack of consent.
• s.37 (commercial use of personal data) is the sleeper. It anchors the 122 commercial-use records and the 90 image cases that dominate the money chapter. GDPR has no direct equivalent, and practitioners trained on European materials routinely miss it.
• s.40 (rectification and erasure) stands behind the single most actionable statistic in this report: 145 records, 48% of the entire corpus, cite a failure to respond to an erasure request. Nearly half of Kenyan enforcement begins with a deletion request somebody ignored.

The tail matters too: 23 records cite obstruction of the Data Commissioner and 12 enforce the registration obligation itself. Both feed the prosecution recommendations in chapter 3, and both are offences a respondent commits during the investigation, not before it.

6. Sector by sector

127 further records are classified "general": the source document states no dominant sector.

Digital lending (42 records) is the signature genre, with an uphold rate of 83%. The script barely varies: an app harvests the borrower's contact list at install, the collections desk messages employers and relatives when repayment slips, the borrower complains, the office orders remediation and sometimes compensation. Its violation profile is unlawful data disclosure (14), failure to respond to erasure request (13), lack of consent (11). The genre's first entry is the record's first determination and its largest group complaint (23 complainants against a lender trading as Pesa Pay).

Banking (40 records) looks different: fewer phone-book harvests, more marketing without consent and rights requests that go unanswered (failure to respond to erasure request (21), lack of consent (11), unlawful data disclosure (9)). The NCBA order in chapter 4 is the sector's cautionary tale, and it began as an erasure request.

Education (15 records) is the sector the September 2023 penalty against Roma School foreshadowed: images of pupils, minors' data published without parental consent, biometric attendance pilots. Its profile: lack of consent (10), commercial use of personal data (10), unauthorised image/photo use (7).

Technology (21), retail (13) and healthcare (13) fill out the top six. The general lesson survives sector detail: the docket tracks consumer-facing data misuse, so exposure scales with how many ordinary Kenyans an organisation touches, not with how much data it holds. A hospital database is a bigger asset than a lender's contact-scraping app; the app generates twenty times the complaints.

7. Appeals and the courts

The Act routes challenges to the High Court, and the striking fact is how little appellate erosion the published record shows. Of 303 records, 302 are final, 1 ongoing and 0 carry an appealed status. No published ODPC determination in the corpus has been overturned on the public record.

The two High Court encounters in the record both ran the regulator's way:

• Tools for Humanity (Worldcoin) judicial review (5 May 2025): the court declared Worldcoin's biometric collection unconstitutional and unlawful, vindicating the ODPC's 2023 intervention.
• Muthoni v Africa International University (16 February 2026): the court adopted an ODPC award as its own order, building the execution bridge.

Honesty requires the caveat: appeals are filed at the High Court, not with the ODPC, and no systematic public register links court challenges back to the determinations they attack. The corpus can say "no overturning appears on the public record"; it cannot say "no determination has been appealed" [W-CHECK: confirm this framing; if you know of pending appeals against ODPC determinations from practice, they belong in this chapter]. What can be said is that the two data points that exist both strengthened the office, and that after Muthoni the cost-benefit of ignoring an award has inverted: non-compliance now invites execution proceedings rather than avoiding them.

8. What a Kenyan controller should actually fear

The record supports a ranked answer.

1. The complaint you ignore. 93% of non-participating respondents lost. Answering the ODPC's first letter, with documents, is the highest-return compliance act in Kenya. Everything else on this list is cheaper than an empty chair.

2. The erasure request nobody owns. 48% of the corpus cites an unanswered erasure request. Most of those began as an email a marketing or collections team never routed anywhere. A working rights-request inbox with a deadline tracker would have prevented nearly half of Kenyan enforcement history.

3. Marketing with someone's face. Median award KES 3,500,000, the record's ceiling at KES 10,000,000, and s.37 liability that does not care whether the person is famous. Image clearance is not a media-industry nicety in Kenya; it is the most expensive line in the violation table.

4. Collections practices that touch third parties. The digital-lending genre generalises: any outreach that uses a data subject's contacts, employer or family as leverage produces complainants who now know where the office is, and it wins there 83% of the time.

5. The investigation itself. 23 obstruction records, 12 registration-enforcement records and 28 prosecution recommendations say the office polices conduct during proceedings as hard as the conduct complained of. Registration status, cooperation and candour are themselves compliance surfaces, and they carry the criminal exposure.

What not to fear, on this record: a GDPR-scale fine. The statute caps penalties at the lower of KES 5,000,000 or one per cent of turnover, the published corpus contains no penalty notice at all, and the money that flows is compensation at a KES 650,000 median. The organisations that get hurt in Kenya are not the ones with imperfect records of processing activities. They are the ones that ignored a letter, a deletion request or a person's photograph.

9. Methodology and about the data

The corpus. 303 verified Kenyan records in the Research Hub tracker as of 2026-07-22: 299 ODPC determinations, 2 ODPC investigations and 2 High Court rulings, spanning 12 June 2023 to 14 April 2026 by decision date. Every record links its source document (determination PDF on odpc.go.ke, or the judgment on kenyalaw.org). Records are verified: human-reviewed against the cited source before publication. Complainant names are never published, even where the regulator publishes them; source links preserve the full record. 140 records carry month (not day) precision dates, as published by the regulator.

What the corpus is not. It is the ODPC's published record, not its full docket (chapter 3 measures the gap), and it contains no administrative penalty notices because none have been published as documents. Press-released penalty figures appear in the narrative, sourced, and are excluded from all statistics. Counts are floors on actual activity, never estimates of it.

The floor methodology. Minimum filing volumes are inferred from the ODPC's own sequential case numbering as cited in published determinations (the highest "Complaint No. N of YYYY" observed is a floor on year-YYYY filings). The inference assumes the numbering is a single sequence per year; the ODPC's annual reports are the authoritative source for official complaint statistics.

Money. Original KES figures are authoritative. USD conversions use documented year-average rates (KES 140/USD for 2023, 132 for 2024, 129 for 2025, 129 for 2026; the table ships with the dataset's migration script) and are rounded. Medians lead throughout; means appear only alongside their median.

The analysis. Every statistic in this report is computed by analyze.py, published alongside the report with its validator; the charts regenerate from the same script. The master dataset is not distributed raw (licensing); every record it holds is inspectable on its own tracker page. If a number here looks wrong, report it to research@lawlab.africa and the correction policy applies.

Citing this report. Wanjiku Karanja, The ODPC Record: How Kenya Enforces Data Protection (Law Lab Africa Research, July 2026), research.lawlab.africa/reports. Free to cite and quote with attribution; commercial reuse of the underlying dataset is licensed separately. Related work: Kenya's ODPC by the numbers and The State of African Data Protection Enforcement, H1 2026.

Law Lab Africa is a technology-law consultancy and research house. The Research Hub turns African regulatory activity into a verified public record: the tracker, the landscape survey, the laws library and this report series. For enforcement alerts as new decisions are tracked, subscribe at research.lawlab.africa/reports.