Aar Healthcare Limited

Complaint upheld; enforcement notice issued. ODPC, 21 September 2023.

Record ID: ke-odpc-2023-0023
Case reference: ODPC Complaint No. 1085 of 2023
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Date decided: 21 September 2023
Respondent type: private
Sector: healthcare
Violations: unlawful data disclosure, failure to prevent data breach, failure to respond to erasure request, failure to notify data breach, unlawful processing, failure to implement security measures
Provisions cited: s.25 DPA 2019, s.26 DPA 2019, s.29 DPA 2019, s.40 DPA 2019, s.41 DPA 2019, s.43 DPA 2019, s.44 DPA 2019, s.56 DPA 2019
Outcome: complaint upheld; enforcement notice issued
Status: final
Source: Official document ↗
Record verified: 12 March 2026

Summary

The ODPC upheld a complaint against Aar Healthcare Limited in the healthcare sector concerning unlawful data disclosure, failure to prevent data breach, failure to respond to erasure request. The determination considers s.25 DPA 2019, s.26 DPA 2019, s.29 DPA 2019, s.40 DPA 2019. An enforcement notice was issued against the respondent.

DATA-BREACH · DATA-SECURITY · DISCLOSURE · HEALTHCARE · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

ODPC (Kenya), ODPC Complaint No. 1085 of 2023, determination of 21 September 2023. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2023/aar-healthcare-limited/ (accessed 22 July 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.