Grace Gatambu v Aar Healthcare Limited

Complaint upheld; enforcement notice issued. ODPC, 21 September 2023.

Record ID

ke-odpc-2023-0023

Case reference

ODPC Complaint No. 1085 of 2023

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Grace Gatambu

Date decided

21 September 2023

Respondent type

private

Sector

healthcare

Violations

unlawful data disclosure, failure to prevent data breach, failure to respond to erasure request, failure to notify data breach, unlawful processing, failure to implement security measures

Provisions cited

s.25 DPA 2019, s.26 DPA 2019, s.29 DPA 2019, s.40 DPA 2019, s.41 DPA 2019, s.43 DPA 2019, s.44 DPA 2019, s.56 DPA 2019

Outcome

complaint upheld; enforcement notice issued

Status

final

Source

Official document ↗

Source integrity

SHA-256 da7cab30ecb1b4f1…

Record verified

30 July 2026

The facts

The complainant's confidential medical information, contained in a medical form from her treatment at the respondent's Roysambu clinic on 24 December 2021, was released to an insurance agent without her consent. The respondent pointed to an email disclaimer but adduced no evidence it was attached, and did not show it asked the agent to erase the data. The Office found violations of her right to be informed, her right to object and her right of erasure.

Orders and outcome

The respondent was found liable and an enforcement notice was ordered to issue against it. Dated 21 September 2023.

DATA-BREACH · DATA-SECURITY · DISCLOSURE · HEALTHCARE · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.