Josephine Ekati Anindo v Ncba Bank Plc

Complaint upheld; enforcement notice issued. ODPC, 11 December 2024.

Record ID

ke-odpc-2024-0107

Case reference

ODPC Complaint No. 1454 of 2024

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Josephine Ekati Anindo

Date decided

11 December 2024

Respondent type

private

Sector

banking

Violations

failure to respond to erasure request, unlawful processing, failure to implement security measures

Provisions cited

s.25(F) DPA 2019, s.25 DPA 2019, s.26 DPA 2019, s.36 DPA 2019, s.40 DPA 2019, s.41(1) DPA 2019, s.56 DPA 2019, s.58 DPA 2019

Outcome

complaint upheld; enforcement notice issued

Status

final

Source

Official document ↗

Source integrity

SHA-256 75590dfab4116c5a…

Record verified

30 July 2026

The facts

The complainant alleged that since March 2024 NCBA Bank repeatedly sent her unsolicited emails, including PIN, password and OTP alerts, mobile transaction notifications, account statements and promotional communications, although she was not the rightful owner of the associated bank account. The ODPC found the bank did not fulfil its obligations under the Act, occasioning a violation against her.

Orders and outcome

The respondent was found liable and an enforcement notice was issued against it. Dated December 2024.

BANKING · DATA-SECURITY · RIGHT-TO-ERASURE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Same respondent

• 30 October 2024 · complaint upheld

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.