Kevin Kiprotich Rono v SBM Bank Kenya

Complaint upheld; compensation ordered. ODPC, 31 May 2024.

Record ID

ke-odpc-2024-0055

Case reference

ODPC Complaint No. 0372 of 2024

Jurisdiction

Kenya

Regulator

ODPC

Type

determination

Complainant

Kevin Kiprotich Rono

Date decided

31 May 2024

Respondent type

private

Sector

general

Violations

unlawful processing

Provisions cited

s.25 DPA 2019, s.26 DPA 2019, s.36 DPA 2019, s.56 DPA 2019, s.65 DPA 2019

Outcome

complaint upheld; compensation ordered

Compensation

KES 450,000 (≈ USD 3,410 at the decision date)

Status

final

Source

Official document ↗

Source integrity

SHA-256 b130fc42e0a459d8…

Record verified

30 July 2026

The facts

The complainant, not a customer of SBM Bank Kenya, kept receiving the bank's emails with PIN and one-time-password alerts, log-in notifications, account statements and promotional offers, despite raising the issue with the bank multiple times. Investigations established the bank had captured its own customer's email address incorrectly at onboarding, and that its claim that the customer provided the complainant's email was false. The processing continued without justification for over a year.

Orders and outcome

The respondent was found liable for unlawfully processing the complainant's personal data and ordered to compensate him Kshs. 450,000, and was directed to collect personal details from its customers accurately to avoid such incidents. Dated May 2024.

GENERAL · UNLAWFUL-PROCESSING · UPHELD

Cite this decision

Track Kenya enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.