Mercy Mwangi v Zaidi Pato Limited

Complaint upheld; enforcement notice issued. ODPC, 6 October 2023.

Record ID: ke-odpc-2023-0025
Case reference: ODPC Complaint No. 1210 of 2023
Jurisdiction: Kenya
Regulator: ODPC
Type: determination
Complainant: Mercy Mwangi
Date decided: 6 October 2023
Respondent type: private
Sector: general
Violations: unlawful data disclosure, failure to respond to erasure request, unlawful processing
Provisions cited: s.25 DPA 2019, s.26 DPA 2019, s.28 DPA 2019, s.29 DPA 2019, s.56 DPA 2019
Outcome: complaint upheld; enforcement notice issued
Status: final
Source: Official document ↗
Source integrity: SHA-256 e752bf5ed18cd841…
Record verified: 30 July 2026

The facts

The complainant alleged that Mokash, a product of Zaidi Pato Limited, sent her unsolicited messages claiming she had guaranteed a loan, which she denied. The Office found the respondent collected her mobile number from its customer for debt recovery without informing her, did not collect the data directly from her, and violated her right to be informed.

Orders and outcome

The respondent was found liable and an enforcement notice was ordered to issue against it. Dated October 2023.

DISCLOSURE · GENERAL · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

ODPC (Kenya), Mercy Mwangi v Zaidi Pato Limited, ODPC Complaint No. 1210 of 2023, determination of 6 October 2023. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2023/zaidi-pato-limited/ (accessed 30 August 2026).

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.