Eric Migwi v Whitepath Company Limited

Complaint upheld; enforcement notice issued. ODPC, 31 July 2023.

Record ID: ke-odpc-2023-0011
Case reference: ODPC Complaint No. 0646 of 2023 as consolidated with ODPC Complaint No. 0719 of 2023
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: Eric Migwi
Date decided: 31 July 2023
Respondent type: private
Sector: digital lending
Violations: unlawful debt collection, failure to respond to erasure request, unlawful processing
Provisions cited: s.25 DPA 2019, s.30 DPA 2019, s.32 DPA 2019, s.32(1) DPA 2019, s.56(1) DPA 2019
Outcome: complaint upheld; enforcement notice issued
Status: final
Source: Official document ↗
Source integrity: SHA-256 64922d69e6a0149d…
Record verified: 30 July 2026

The facts

Two consolidated complaints alleged Whitepath Company Limited sent incessant messages demanding payment from the complainants as guarantors of loans they knew nothing about, without ever contacting them to consent to being guarantors. The burden of proving consent lay on the respondent, and no evidence of consent was adduced, so the Office found the processing of the complainants' personal data unlawful.

Orders and outcome

The respondent was found liable and an enforcement notice was ordered to issue. Dated 2023.

DEBT-COLLECTION · FINTECH · MOBILE-LENDING · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

ODPC (Kenya), Eric Migwi v Whitepath Company Limited, ODPC Complaint No. 0646 of 2023 as consolidated with ODPC Complaint No. 0719 of 2023, determination of 31 July 2023. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2023/whitepath-company-limited/ (accessed 30 August 2026).

Same respondent

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.