violation of right to access, violation of right to correction, failure to conduct dpia, failure to notify data breach, failure to implement adequate safeguards
The complainant, a Bolt driver, alleged that in May 2023 his driver account was compromised: he was contacted about another driver using his account, then found himself locked out with his email and password no longer recognised, and discovered fraudulent rides being conducted under his identity. He reported the matter to the respondent and the police without resolution, and asserted that internal employees or agents of the respondent involved in the fraud were terminated. The ODPC found the respondent violated his rights of access to his personal data and correction of false or misleading data.
Orders and outcome
The respondent was found liable, ordered to pay the complainant Kenya Shillings Five Hundred Thousand (KES 500,000) as compensation, and an enforcement notice was issued against it. Dated June 2024.
ODPC (Kenya), Kennedy Wainaina Mbugua v Bolt Operations OU / Bolt Support Kenya Limited, ODPC Complaint No. 0497 of 2024, determination of July 2024. African Data Protection Enforcement Tracker, Law Lab Africa Research, https://research.lawlab.africa/tracker/kenya/odpc/2024/bolt-operations-ou-bolt-support-kenya-limited/ (accessed 23 October 2026).
Track Kenya enforcement
Free: a monthly digest of new verified decisions in your chosen jurisdictions. You confirm by email before anything is sent; every alert has an unsubscribe link. Privacy · Terms.