Safaricom Plc

Complaint dismissed; prosecution recommended. ODPC, 3 October 2023.

Record ID: ke-odpc-2023-0024
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Date decided: 3 October 2023
Respondent type: private
Sector: telecoms
Violations: lack of consent, unlawful data disclosure, failure to prevent data breach, unlawful processing, failure to implement security measures
Provisions cited: s.25 DPA 2019, s.41 DPA 2019, s.56 DPA 2019
Outcome: complaint dismissed; prosecution recommended
Status: final
Source: Official document ↗
Record verified: 6 July 2026

Summary

The ODPC dismissed a complaint against Safaricom Plc in the telecom sector alleging lack of consent, unlawful data disclosure, failure to prevent data breach. The determination considers s.25 DPA 2019, s.41 DPA 2019, s.56 DPA 2019. A recommendation for prosecution was made.

CONSENT · DATA-BREACH · DATA-SECURITY · DISCLOSURE · TELCO · TELECOM · UNLAWFUL-PROCESSING

Cite this decision

ODPC (Kenya), Safaricom Plc, determination of 3 October 2023. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2023/safaricom-plc/ (accessed 22 July 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.