Rose Wambui Muigai v Ncba Bank Plc

Complaint upheld; compensation ordered; enforcement notice issued. ODPC, 30 October 2024.

Record ID

ke-odpc-2024-0099

Case reference

ODPC Complaint No. 1178 of 2024

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Rose Wambui Muigai

Date decided

30 October 2024

Respondent type

private

Sector

banking

Violations

lack of consent, unlawful data disclosure, failure to prevent data breach, unlawful processing, failure to implement security measures

Provisions cited

s.25(a) DPA 2019, s.25 DPA 2019, s.41(1) DPA 2019, s.43(a) DPA 2019, s.56 DPA 2019, s.58 DPA 2019, s.65 DPA 2019

Outcome

complaint upheld; compensation ordered; enforcement notice issued

Compensation

KES 250,000 (≈ USD 1,890 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 174cce99b59e525f…

Record verified

30 July 2026

The facts

The complainant alleged that between May 2023 and May 2024 NCBA Bank processed her personal data in violation of data protection laws, with former employees of the bank using her personal data to contact her about renewing her insurance cover. The ODPC found the bank did not fulfil its obligations under the Act.

Orders and outcome

The respondent was found liable, ordered to compensate the complainant KES 250,000, and an enforcement notice was issued against it. Date page OCR-garbled; spine date 30 October 2024.

BANKING · CONSENT · DATA-BREACH · DATA-SECURITY · DISCLOSURE · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Same respondent

• 11 December 2024 · complaint upheld

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.